Analytics BIOC Low
✕

Unusual Encrypting File System Remote call (EFSRPC) to domain controller

An unusual Encrypting File System Remote call (EFSRPC) was made to a domain controller.

Module:
Identity Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Forced Authentication (T1187) Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001)
Attacker's goals:

An attacker can abuse the Encrypting File System Remote Protocol to coerce authentication from a DC. This authentication can later be used for obtaining a DC certificate for DCSync.

Investigative actions:

Check for a suspicious process on the initiator. Check if the source host is a vulnerability scanner. Check for unusual connections from the server of the requested file location (it may be a relay server). Look for unusual AD CS certificate requests. Look for following suspicious connections using the DC machine account. Check for possible DCSync alerts.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • A suspicious Encrypting File System Remote call (EFSRPC) was made to a domain controller Medium (parent: Low)
  • Abnormal Encrypting File System Remote call (EFSRPC) to domain controller using EfsRpcFileKeyInfo for the first time Low
  • Abnormal Encrypting File System Remote call (EFSRPC) to domain controller using EfsRpcFileKeyInfo Informational (parent: Low)