Vulnerability: Microsoft Windows RPC Encrypted Data Detected Mean???

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Vulnerability: Microsoft Windows RPC Encrypted Data Detected Mean???

L0 Member

hi;

 

How to remove this message: Microsoft Windows RPC Encrypted Data Detected from a windows 10 computer that palo alto always report this type of thread???

 

Whats mean Microsoft Windows RPC Encrypted Data Detected???

3 REPLIES 3

L5 Sessionator

In addition to the explanation that Rodgerfoster provided above, I add some comments here.


This signature triggers when it sees encrypted MSRPC traffic, which can be used for evasion but also can be used legitimately. Thus, the severity is 'low' and the default action set to 'alert'.

Here's the description of the signature.
https://threatvault.paloaltonetworks.com/?query=33836&type=
"This signature indicates that encrypted MSRPC data is seen. Though, encrypted traffic is sometimes used, it is also seen in cases of evasion. Attackers could use the technique to evade IPS boxes and thus sneak MSRPC exploits."


With this type of signature, I'd suggest to review the traffic (traffic log, etc) to see if it's known traffic. If you think that your traffic is legitimate, you can add a threat exception for this signature 33836.

References:
HOW TO CREATE A VULNERABILITY EXCEPTION
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm4yCAC
WHAT IS THE BEHAVIOR WHEN IP ADDRESS/S ARE ADDED UNDER "IP-ADDRESS-EXEMPTIONS" FOR SPYWARE/THREAT EXCEPTION?
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UscCAE

 

If you are unsure if the traffic is legitimate or not, you can collect some data and check with Palo Alto Networks support.
HOW TO SUBMIT A VULNERABILITY SIGNATURE FALSE POSITIVE
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSBCA0

L2 Linker

Was a proper secure solution ever found? Creating an exclusion when the destination is your domain controllers isn't really safe. 

L2 Linker

"Though, encrypted traffic is sometimes used"

Like Clients talking to a Domain Controller? 

Are there any recommended exclusions? Known False Positives? 

Right now, we are looking to have to disable this on the Client VPN and all East/West Traffic to DC's which seems pretty large. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!