| external help file | DSInternals.Win32.RpcFilters.PowerShell.dll-Help.xml |
|---|---|
| Module Name | DSInternals.RpcFilters |
| online version | https://github.com/MichaelGrafnetter/RPCFilterManager/blob/main/Documentation/PowerShell/New-RpcFilter.md |
| schema | 2.0.0 |
Creates a new RPC filter for managing remote procedure call (RPC) traffic based on specified criteria.
New-RpcFilter [-PassThrough] [-BootTimeEnforced] [-Persistent] [-Name <String>] [-Description <String>]
[-ImageName <String>] [-NamedPipe <String>] [-FilterKey <Guid>] [-DcomAppId <Guid>] [-InterfaceUUID <Guid>]
-Action <RpcFilterAction> [-Audit <RpcFilterAuditOptions>] [-AuthenticationLevel <RpcAuthenticationLevel>]
[-AuthenticationLevelMatchType <NumericMatchType>] [-AuthenticationType <RpcAuthenticationType>]
[-Transport <RpcProtocolSequence>] [-SecurityDescriptor <RawSecurityDescriptor>]
[-SecurityDescriptorNegativeMatch] [-RemoteAddress <IPAddress>] [-RemoteAddressMask <Byte>]
[-LocalAddress <IPAddress>] [-LocalAddressMask <Byte>] [-LocalPort <UInt16>] [-Weight <UInt64>]
[-OperationNumber <UInt16>] [<CommonParameters>]
New-RpcFilter [-PassThrough] [-BootTimeEnforced] [-Persistent] [-Name <String>] [-Description <String>]
[-ImageName <String>] [-NamedPipe <String>] [-FilterKey <Guid>] [-DcomAppId <Guid>]
-WellKnownProtocol <WellKnownProtocol> -Action <RpcFilterAction> [-Audit <RpcFilterAuditOptions>]
[-AuthenticationLevel <RpcAuthenticationLevel>] [-AuthenticationLevelMatchType <NumericMatchType>]
[-AuthenticationType <RpcAuthenticationType>] [-Transport <RpcProtocolSequence>]
[-SecurityDescriptor <RawSecurityDescriptor>] [-SecurityDescriptorNegativeMatch] [-RemoteAddress <IPAddress>]
[-RemoteAddressMask <Byte>] [-LocalAddress <IPAddress>] [-LocalAddressMask <Byte>] [-LocalPort <UInt16>]
[-Weight <UInt64>] [-OperationNumber <UInt16>] [<CommonParameters>]
New-RpcFilter [-PassThrough] [-BootTimeEnforced] [-Persistent] [-Name <String>] [-Description <String>]
[-ImageName <String>] [-NamedPipe <String>] [-FilterKey <Guid>] [-DcomAppId <Guid>]
-WellKnownOperation <WellKnownOperation> -Action <RpcFilterAction> [-Audit <RpcFilterAuditOptions>]
[-AuthenticationLevel <RpcAuthenticationLevel>] [-AuthenticationLevelMatchType <NumericMatchType>]
[-AuthenticationType <RpcAuthenticationType>] [-Transport <RpcProtocolSequence>]
[-SecurityDescriptor <RawSecurityDescriptor>] [-SecurityDescriptorNegativeMatch] [-RemoteAddress <IPAddress>]
[-RemoteAddressMask <Byte>] [-LocalAddress <IPAddress>] [-LocalAddressMask <Byte>] [-LocalPort <UInt16>]
[-Weight <UInt64>] [<CommonParameters>]
This cmdlet creates a new RPC filter for managing remote procedure call (RPC) traffic based on specified criteria. The filter can be customized using various parameters to define its behavior and conditions.
PS C:\> New-RpcFilter -Name 'Block-SCMR-NP' -Description 'Block MS-SCMR over Named Pipes' -WellKnownProtocol ServiceControlManager -Transport ncacn_np -Action Block -Audit EnabledCreates a new RPC filter to block and audit service management (MS-SCMR) traffic over Named Pipes.
Specifies the action to be performed if all the filter conditions are true.
Type: RpcFilterAction
Parameter Sets: (All)
Aliases:
Accepted values: Block, Permit, CalloutUnknown, CalloutTerminating, CalloutInspection
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseIndicates whether incoming RPC calls are audited as part of C2 and common criteria compliance. Supported values are Disabled, Enabled, and EnabledWithParams.
Type: RpcFilterAuditOptions
Parameter Sets: (All)
Aliases: AuditOptions, Auditing
Required: False
Position: Named
Default value: Disabled
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe authentication level controls how much security a client or server wants from its SSP.
Type: RpcAuthenticationLevel
Parameter Sets: (All)
Aliases: AuthLevel
Accepted values: Default, None, Connect, Call, Packet, PacketIntegrity, PacketPrivacy
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe match type (operator) for the authentication level.
Type: NumericMatchType
Parameter Sets: (All)
Aliases: AuthLevelMatch, AuthLevelMatchType, AuthenticationLevelMatch
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseAuthentication service used for RPC connections.
Type: RpcAuthenticationType
Parameter Sets: (All)
Aliases: AuthType
Accepted values: None, Negotiate, NTLM, SChannel, Kerberos, Digest, Default
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseIndicates whether the filter is enforced at boot-time, even before BFE starts.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: Boot
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseThe identification of the COM application.
Type: Guid
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseOptional filter description.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseUnique identifier of the filter.
Type: Guid
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe name of the application.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe UUID of the RPC interface.
Type: Guid
Parameter Sets: CustomProtocol
Aliases: RpcProtocol, Protocol, ProtocolUUID
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe local IP address.
Type: IPAddress
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe local IP address mask.
Type: Byte
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe local transport protocol port number.
Type: UInt16
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseHuman-readable RPC filter name.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe name of the remote named pipe.
Type: String
Parameter Sets: (All)
Aliases: Pipe, PipeName
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe RPC operation number for an RPC call made to an RPC listener.
Type: UInt16
Parameter Sets: CustomProtocol, WellKnownProtocol
Aliases: OpNum
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseIndicates whether to return the object that was created by the cmdlet.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseIndicates whether the filter is persistent, that is, it survives across BFE stop/start.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseThe remote IP address.
Type: IPAddress
Parameter Sets: (All)
Aliases: IPAddress, Address
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe remote IP address mask.
Type: Byte
Parameter Sets: (All)
Aliases: Mask, PrefixLength, Prefix, RemoteAddressPrefix, RemoteAddressPrefixLength
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe identification of the remote user in SDDL form.
Type: RawSecurityDescriptor
Parameter Sets: (All)
Aliases: SDDL, Permissions, DACL
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseIndicates whether to match the security descriptor negatively (i.e., NOT match).
Type: SwitchParameter
Parameter Sets: (All)
Aliases: PermissionsNegativeMatch, SecurityDescriptorNegate, PermissionsNegate
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseProtocol family used by the RPC endpoint.
Type: RpcProtocolSequence
Parameter Sets: (All)
Aliases: ProtSeq, Binding, ProtocolSequence
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThe weight indicates the priority of the filter, where higher-numbered weights have higher priorities.
Type: UInt64
Parameter Sets: (All)
Aliases: WeightRange
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseSpecifies a well-known RPC operation. The protocol UUID and operation number is derived from the specified value.
Type: WellKnownOperation
Parameter Sets: WellKnownOperation
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseSpecifies a well-known RPC protocol. The protocol UUID is derived from the specified value.
Type: WellKnownProtocol
Parameter Sets: WellKnownProtocol
Aliases: WellKnownInterface
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThis cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.