MSRPC traffic : ncacn_np transport

• MSRPC traffic : ncacn_np transport

  • SMB session to the IPC$ share (ncacn_np MSRPC transport)
  • ethereal display filter: dcerpc && smb
  • Named pipes name identify the MSRPC interface
    • \pipe\lsarpc : lsarpc interface
    • \pipe\samr : samr interface
    • \pipe\netlogon : netlogon interface
  • ncacn_np transport used during an Active Directory join and unjoin process
    • Access to the samr interface via \pipe\samr: computer account administration
  • Domain controllers access to lsarpc and netlogon interfaces
    • Including for netlogon operations added in Active Directory