Lifting the Fog of War - Monitoring, Identifying and Mitigating MS-RPC Based Threats
No ratings
Presented at BlackHat USA 2023 by
MS-RPC is Microsoft's implementation of the Remote Procedure Calls protocol. The protocol is highly integral to the operation of Windows and serves as the basis for nearly all Windows services on both managed and unmanaged networks. As such, it is also the behind-the-scenes driving force for many lateral movement techniques and exploits, such as PSExec, PetitPotam, DCSync and more.While much focus is given to attacks over RPC, there are also built-in mechanisms that defenders can utilize to mitigate some of the threats and attacks that RPC can carry. These include the RPC ETW provider and the RPC filters in the Windows firewall.Monitoring RPC traffic is a difficult task, since most of the traffic is legitimate, and it is hard to distinguish between benign and malicious requests. In order to aid network defenders, we will share a tool that we built, that eases interaction with the RPC ETW provider, enriches event data and helps in visualizing it. We'll present some inherent shortcomings in the ETW provider (such as missing data in some events or troublesome event correlation) and how we overcame them.In this talk, we will present how defenders and analysts can utilize these features in Windows to track and defend against RPC-based attacks. We will also demonstrate their effectiveness in analyzing RPC data and detecting malicious traffic. Finally, we will share signatures that we wrote to detect many common lateral movement techniques and one-days.