Thrift RPC Method from an External Client

Last updated 3 days ago on 2026-07-30

Created 3 days ago on 2026-07-30

About

Identifies the first decoded Apache Thrift RPC relationship from a public client address to a server. Thrift commonly connects trusted internal microservices and data platforms, and an externally originated method invocation can indicate an exposed service, unauthorized access, or exploitation of a public-facing Thrift endpoint.

Tags

Domain: NetworkUse Case: Network Security MonitoringUse Case: Threat DetectionTactic: Initial AccessData Source: Network Packet CaptureLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Exploit Public-Facing Application (T1190)(external, opens in a new tab or window)

False Positive Examples

Publicly accessible Thrift APIs, partner integrations, remote offices, and routed environments that preserve public client addresses can generate legitimate alerts. Validate the client, service, method, server role, and expected network path before escalating.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-network_traffic.thrift-*
Related Integrations: network_traffic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:network_traffic.thrift and
client.ip:(
  * and
  not (
    10.0.0.0/8 or
    100.64.0.0/10 or
    127.0.0.0/8 or
    169.254.0.0/16 or
    172.16.0.0/12 or
    192.0.0.0/24 or
    192.0.2.0/24 or
    192.31.196.0/24 or
    192.52.193.0/24 or
    192.88.99.0/24 or
    192.168.0.0/16 or
    192.175.48.0/24 or
    198.18.0.0/15 or
    198.51.100.0/24 or
    203.0.113.0/24 or
    224.0.0.0/4 or
    240.0.0.0/4 or
    "::1" or
    "fc00::/7" or
    "fe80::/10" or
    "ff00::/8"
  )
) and
server.ip:* and
network_traffic.thrift.method:*

Install detection rules in Elastic Security

Detect Thrift RPC Method from an External Client in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).