Signature Detail

MS-RPC: Epdump Scan Detected

This anomaly detects a client enumerating MSRPC endpoints on a windows server. This can indicate a probing scan prior to a more sophisticated attack.

Extended Description

A remote attacker could enumerate the MSRPC services on a Windows Server by using EPDump to systematically query the End Point Mapper. With this information, an attacker could plan attacks to compromise the server.

References

• CVE: CVE-2007-1748
• URL: http://www.iss.net/security_center/advice/Intrusions/2002801/default.htm
• URL: https://services.netscreen.com/restricted/sigupdates/nsm-updates/HTML/MS-RPC:EPDUMP-SCAN.html
• URL: http://www.opengroup.org/onlinepubs/9629399/apdxh.htm