Vulnerability: Microsoft Windows RPC Encrypted Data Detected Mean???

[ALEX_RCM]

hi;

How to remove this message: Microsoft Windows RPC Encrypted Data Detected from a windows 10 computer that palo alto always report this type of thread???

Whats mean Microsoft Windows RPC Encrypted Data Detected???

[ymiyashita]

In addition to the explanation that Rodgerfoster provided above, I add some comments here.

This signature triggers when it sees encrypted MSRPC traffic, which can be used for evasion but also can be used legitimately. Thus, the severity is 'low' and the default action set to 'alert'.

Here's the description of the signature.
https://threatvault.paloaltonetworks.com/?query=33836&type=
"This signature indicates that encrypted MSRPC data is seen. Though, encrypted traffic is sometimes used, it is also seen in cases of evasion. Attackers could use the technique to evade IPS boxes and thus sneak MSRPC exploits."

With this type of signature, I'd suggest to review the traffic (traffic log, etc) to see if it's known traffic. If you think that your traffic is legitimate, you can add a threat exception for this signature 33836.

References:
HOW TO CREATE A VULNERABILITY EXCEPTION
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm4yCAC
WHAT IS THE BEHAVIOR WHEN IP ADDRESS/S ARE ADDED UNDER "IP-ADDRESS-EXEMPTIONS" FOR SPYWARE/THREAT EXCEPTION?
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UscCAE

If you are unsure if the traffic is legitimate or not, you can collect some data and check with Palo Alto Networks support.
HOW TO SUBMIT A VULNERABILITY SIGNATURE FALSE POSITIVE
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSBCA0

[eumbach]

Was a proper secure solution ever found? Creating an exclusion when the destination is your domain controllers isn't really safe. 

[eumbach]

"Though, encrypted traffic is sometimes used"

Like Clients talking to a Domain Controller? 

Are there any recommended exclusions? Known False Positives? 

Right now, we are looking to have to disable this on the Client VPN and all East/West Traffic to DC's which seems pretty large.