modernexecserver.dll RPC interface

version info says "Modern Execution Server". I don`t know what this means
8EC21E98-B5CE-4916-A3D6-449FA428A007 version 0.0
19 methods:

• FmMuxSrvRegisterCoreUIEndpoints
• FmMuxSrvLaunchTask
• FmMuxSrvResumeTask
• FmMuxSrvPauseTask
• FmMuxSrvCancelTask
• FmMuxSrvAbortTask
• FmMuxSrvGetTaskPid
• FmMuxSrvSetTaskDehydrationEligibility
• FmMuxSrvResolveApplicationUri
• FmMuxSrvGetActivationPolicy
• FmMuxSrvShutdown
• FmMuxSrvSetForegroundTaskInstanceId
• FmMuxSrvGenerateActivationInstanceId
• FmMuxSrvActivationPrerequisitePhase
• FmMuxSrvIsCBETask
• FmMuxSrvIsValidTaskPid
• FmMuxSrvResumePrerequisitePhase
• FmMuxSrvGetForegroundTaskInstanceId
• FmMuxSrvActivationBypass

srvsvc.dll RPC interfaces

Server Service DLL

Например под windows 8 интерфейс srvsvc имеет версию 3.0 и 0x45 методов
Добавленные методы:
0x3A: LocalrSessionEnum
0x3B: LocalrSessionGetInfo
0x3C: LocalrSessionDel
0x3D: LocalrFileEnum
0x3E: LocalrFileGetInfo
0x3F: LocalrFileClose
0x40: LocalrShareEnum
0x41: LocalrShareGetInfo
0x42: LocalrShareSetInfo
0x43: LocalrShareAdd
0x44: LocalrShareDelEx


XactSrv 98716D03-89AC-44C7-BB8C-285824E51C4A version 1.0
регистрируется в epmapper с аннотацией XactSrv service
6 methods:

• XsOpenPrinter
• XsClosePrinter
• XsAddJob
• XsScheduleJob
• XsProcessPnp
• XsProcDownLevelAPI

 вызывается через msrpc из драйвера srvnet.sys

IdSegSrv 1A0D010F-1C33-432C-B0F5-8CF4E8053099 version 1.0
регистрируется в epmapper с аннотацией IdSegSrv service
2 methods:

• IdSegRequestNextSequence
• IdSegRequestNodeInvalidation

 вызывается через msrpc из драйвера srvnet.sys

wkssvc.dll RPC interfaces

Workstation Service DLL
кроме всем известного wkssvc под windows 8 имеет следующие RPC интерфейсы:

F2C9B409-C1C9-4100-8639-D8AB1486694A version 1.0
регистрируется в epmapper с аннотацией Witness Client Upcall Server
2 methods:

• ClusterConnectUpcall
• ClusterDisConnectUpcall

вызывается через msrpc из драйвера mrxsmb.sys

EB081A0D-10EE-478A-A1DD-50995283E7A8 version 3.0
регистрируется в epmapper с аннотацией Witness Client Test Interface
1 method:

• GetWitnessNodes

7F1343FE-50A9-4927-A778-0C5859517BAC version 1.0
регистрируется в epmapper с аннотацией DfsDs service
4 methods:

• DfsDsGetDcName
• DfsDsIsDomainController
• DfsCredWrite
• DfsCredDelete

вызывается через msrpc из драйвера dfsc.sys

connhlp.dll RPC interface

Connectivity Helper API
cpprovider 6F201A55-A24D-495F-AAC9-2F4FCE34DF99 version 1.0
0xd methods:

• SpiEstablishSession
• SpiTerminateSession
• SpiTransitionFromDormantToActive
• SpiTransitionFromActiveToDormant
• SpiAddTransportId
• SpiRemoveTransportId
• SpiIsRemoteTransportIdReachable
• SpiSendData
• SpiReceiveData
• SpiReceiveAuthorizeCallback
• SpiReceiveAuthorizeCallbackComplete
• SpiQueryPeerLinkInformation
• SpiQueryProviderSubscriptionInformation

 вызывается через msrpc из драйвера tunnel.sys

efssvc.dll RPC interfaces

EFS Service
efsrpc DF1941C5-FE89-4E79-BF10-463657ACF44D version 1.0
0x15 methods:

• EfsRpcOpenFileRaw
• EfsRpcReadFileRaw
• EfsRpcWriteFileRaw
• EfsRpcCloseRaw
• EfsRpcEncryptFileSrv
• EfsRpcDecryptFileSrv
• EfsRpcQueryUsersOnFile
• EfsRpcQueryRecoveryAgents
• EfsRpcRemoveUsersFromFile
• EfsRpcAddUsersToFile
• EfsRpcSetFileEncryptionKey
• EfsRpcNotSupported
• EfsRpcFileKeyInfo
• EfsRpcDuplicateEncryptionInfoFile
• EfsUsePinForEncryptedFiles
• EfsRpcAddUsersToFileEx
• EfsRpcFileKeyInfoEx
• EfsRpcGenerateEfsStream
• EfsRpcGetEncryptedFileMetadata
• EfsRpcSetEncryptedFileMetadata
• EfsRpcFlushEfsCache

efskrpc 04EEB297-CBF4-466B-8A2A-BFD6A2F10BBA version 1.0
4 methods

• EfsKRpcEstablishRpcConnection
• EfsKRpcDecryptFek
• EfsKRpcGenerateKey
• EfsKRpcGenerateDirEfs

вызывается через msrpc.sys из драйвера ntfs например

wininet.dll RPC interfaces

CAD784CB-4C1B-4D96-B8F7-4716B568B13C version 1.0
0x37 methods:

• s_UrlCacheGetManagerInterface
• s_UrlCachePingServer
• s_UrlCacheOpenContainer
• s_UrlCacheCloseContainer
• s_UrlCacheAddUrl
• s_UrlCacheLookupUrl
• s_UrlCacheCheckUrlsExist
• s_UrlCacheGetUrlBinaryBlob
• s_UrlCacheAddUrlBinaryBlob
• s_UrlCacheDeleteUrl
• s_UrlCacheUnlockUrl
• s_UrlCacheUpdateUrl
• s_UrlCacheEntryEnum
• s_UrlCacheEntryEnumClose
• s_UrlCacheEntryEnumNext
• s_UrlCacheCleanupUrls
• s_UrlCacheGetSize
• s_UrlCacheGetLimit
• s_UrlCacheSetLimit
• s_UrlCacheGetBloomFilter
• s_UrlCacheGetNextDirectory
• s_UrlCacheAddLeakFile
• s_UrlCacheCreateGroup
• s_UrlCacheDeleteGroup
• s_UrlCacheGetGroupIds
• s_UrlCacheGetGroup
• s_UrlCacheUpdateGroup
• s_UrlCacheSetUrlGroup
• s_UrlCacheGetContentContainerDirectories
• s_UrlCacheCreateExtensibleContainer
• s_UrlCacheDeleteExtensibleContainer
• s_UrlCacheGetExtensibleContainersList
• s_UrlCacheRpcSetGlobalLimit
• s_UrlCacheRpcGetGlobalLimit
• s_AppCacheOpenContainer
• s_AppCacheCloseContainer
• s_AppCacheRpcCheckManifest
• s_AppCacheRpcLookup
• s_AppCacheRpcDeleteGroup
• s_AppCacheRpcDeleteIeGroup
• s_AppCacheRpcGetFallbackUrl
• s_AppCacheRpcGetDownloadList
• s_AppCacheRpcCloseHandle
• s_AppCacheRpcGetInfo
• s_AppCacheRpcGetGroupsList
• s_AppCacheRpcGetIeGroupList
• s_AppCacheRpcFreeIeSpace
• s_AppCacheRpcRetrieveUrl
• s_AppCacheRpcCommitUrl
• s_AppCacheRpcFinalize
• s_DependencyStoreOpenContainer
• s_DependencyStoreCloseContainer
• s_DependencyStoreUpdateUrl
• s_DependencyStoreRetrieveUrl
• s_DependencyStoreDeleteContainer

7856FB07-7EFE-4029-A4CB-4848641C40FF version 1.0
0x1F methods:

• s_IDBFactory_openDatabase
• s_IDBFactory_deleteDatabase
• s_IDBDatabase_createObjectStore
• s_IDBDatabase_deleteObjectStore
• s_IDBDatabase_setVersion
• s_IDBDatabase_transaction
• s_IDBDatabase_close
• s_IDBTransaction_openObjectStore
• s_IDBTransaction_abortAndClose
• s_IDBTransaction_commitAndClose
• s_IDBObjectStore_put
• s_IDBObjectStore_add
• s_IDBObjectStore_get
• s_IDBObjectStore_getFromKeyRange
• s_IDBObjectStore_delete
• s_IDBObjectStore_clear
• s_IDBObjectStore_openCursor
• s_IDBObjectStore_createIndex
• s_IDBObjectStore_openIndex
• s_IDBObjectStore_deleteIndex
• s_IDBObjectStore_close
• s_IDBIndex_openCursor
• s_IDBIndex_get
• s_IDBIndex_getFromKeyRange
• s_IDBIndex_getKey
• s_IDBIndex_getKeyFromKeyRange
• s_IDBIndex_close
• s_IDBCursor_update
• s_IDBCursor_continue
• s_IDBCursor_delete
• s_IDBCursor_close

appidsvc.dll RPC interface

Application Identity Service
8A7B5006-CC13-11DB-9705-005056C00008 version 1.0
2 methods:

• AppIDRpcVerifyFile
• AppIDRpcVerifyPackageMoniker

Регистрирует себя в epmapper с аннотацией AppIDSvc
Вызывается через msrpc из драйвера appid.sys

DeviceSetupManager.dll RPC Interfaces

Device Setup Manager. Судя по названию - крайне перспективный модуль, бгг
420BCA2F-A0E8-45F4-A8FF-906745E8876C version 1.0
3 methods:

• DsmRpcOpenDevice
• DsmRpcCloseDevice
• DsmRpcGetDeviceNotification

F19C345C-5E00-4CB4-B1D1-EFF9EA31B166 version 1.0
8 methods:

• DsmRpcInstallDevice
• DsmRpcUninstallDevice
• DsmRpcRemoveDevice
• DsmRpcForceRefreshDevice
• DsmRpcRunJob
• DsmRpcScanForAutoConfigure
• DsmRpcGetServiceInfo
• DsmRpcQueueJobTest

3D27921D-9A28-483F-A749-A48FDE7D0C5F version 1.0
6 methods:

• DsmRpcRefreshAllDevices
• DsmRpcRefreshDevice
• DsmRpcSetInstallBehavior
• DsmRpcGetInstallBehavior
• DsmRpcNonAdminRemoveDevice
• DsmRpcWaitServiceReady

Имеют место быть на всяких разных endpoints, например:

• \\PIPE\atsvc
• \\PIPE\browser
• \\PIPE\srvsvc
• ALPC port DeviceSetupManager
• ALPC port IUserProfile2
• и так далее

bisrv.dll RPC Interfaces

Broker Infrastructure Service
2D98A740-581D-41B9-AA0D-A88B9D5CE938 version 1.0
14 methods:

• RBiSrvAssociateActivationProxy
• RBiSrvAssociateApplicationExtensionClass
• RBiSrvCreateEvent
• RBiSrvDeleteEvent
• RBiSrvDisassociateWorkItem
• RBiSrvEnumerateBrokeredEvents
• RBiSrvEnumerateUserSessions
• RBiSrvEnumerateWorkItems
• RBiSrvQueryBrokeredEvent
• RBiSrvQuerySystemStateBroadcastChannels
• RBiSrvQueryWorkItem
• RBiSrvQueryUserSession
• RBiSrvSignalEvent
• RBiSrvSignalMultipleEvents

8BFC3BE1-6DEF-4E2D-AF74-7C47CD0ADE4A version 1.0
4 methods:

• RBiSrvChangeApplicationState
• RBiSrvNotifyNewSession
• RBiSrvNotifyEndSession
• RBiSrvUpdateLockScreenApplications

1B37CA91-76B1-4F5E-A3C7-2ABFC61F2BB0 version 1.0
9 methods:

• RBiRtSrvAssociateWorkItem
• RBiRtSrvCreateEvent
• RBiRtSrvCreateStatusStateName
• RBiRtSrvDeleteEvent
• RBiRtSrvDisassociateWorkItem
• RBiRtSrvEnumerateWorkItems
• RBiRtSrvGetWorkItemProperties
• RBiRtSrvRegisterWorkItem
• RBiRtSrvSignalEvent

C605F9FB-F0A3-4E2A-A073-73560F8D9E3E version 1.0
1 method:

• RBiSrvSignalEvent

httpprxm.dll RPC Interfaces

Proxy Manager
Registering in epmapper with annotation "Proxy Manager client server endpoint"
C36BE077-E14B-4FE9-8ABC-E856EF4F048B version 1.0
6 methods:

• RpcSrvProxyMgrClientRegisterForEventNotification
• RpcSrvProxyMgrClientGetNotification
• RpcSrvProxyMgrClientUnregisterEventNotification
• RpcSrvProxyMgrClientGetProxyForUrl
• RpcSrvProxyMgrClientGetProxyCredentials
• RpcSrvProxyMgrClientGetAllProxiesForUrl

Registering in epmapper with annotation "Proxy Manager provider server endpoint"
2E6035B2-E8F1-41A7-A044-656B439C4C34 version 1.0
6 methods:

• ProxyMgrProviderRegisterForEventNotification
• ProxyMgrProviderUnregisterEventNotification
• ProxyMgrProviderGetNotification
• ProxyMgrGetProxyEventInformation
• ProxyMgrSetProxyConfiguration
• ProxyMgrSetProxyCredentials

adhsvc.dll RPC interface

AD Harvest Sites and Subnets Service
C49A5A70-8A7F-4E70-BA16-1E8F1F193EF1 version 1.0
7 methods:

• AdhEngineOpen
• AdhEngineClose
• AdhStatusEventSubscribe
• AdhStatusEventSubscriptionGetLastEvent
• AdhStatusEventUnsubscribe
• AdhGetConfig
• AdhGetEvidenceCollectorResult

das.dll RPC interfaces

Device Association Service
850CEE52-3038-4277-B9B4-E05DB8B2C35C version 1.0
0xC methods:

• DASCreateAssociationContext
• DASEnumAssociationCeremonies
• DASBeginAssociationCeremony
• DASReadCeremonyData
• DASWriteCeremonyData
• DASEndAssociationCeremony
• DASCloseAssociationContext
• DASCreateAssociationContextFromOOBData
• DASRemoveAssociation
• DASCreateChallengeContext
• DASChallengeDevicePresence
• DASCloseChallengeContext

BD84CD86-9825-4376-813D-334C543F89B1  version 1.0
4 methods:

• RpcDevQueryCreate
• RpcDevQueryClose
• RpcDevQueryGetResult
• RpcDevPropertySet

В w8 висит на множестве endpoints - например

• \\PIPE\\atsvc
• \\PIPE\\browser
• \\PIPE\\srvsvc
• ALPC port DeviceSetupManager
•  ALPC port IUserProfile2
• ALPC port senssvc

ncbservice.dll RPC interface

Network Connection Broker
880FD55E-43B9-11E0-B1A8-CF4EDFD72085 version 1.0
4 methods:

• KapiRegisterProvider
• KapiDeregisterProvider
• KapiUpdateKaSample
• KapiReceiveKaUpdateRequest

В w8 висит на множестве endpoints - например

• \\PIPE\\atsvc
• \\PIPE\\browser
• \\PIPE\\srvsvc
• ALPC port DeviceSetupManager
• ALPC port IUserProfile2

и так далее - мне лень все перечислять

tcp_dcerpc_auditor.rb

мне кажется metasploit занимается совершенно социалистическими приписками - например из их списочка IIDs гугл практически ничего не знает про следующие:

• 04fcb220-fcfd-11cd-bec8-00aa0047ae4e
• 0a5a5830-58e0-11ce-a3cc-00aa00607271
• 0c821d64-a3fc-11d1-bb7a-0080c75e4ec1
• 0da5a86c-12c2-4943-30ab-7f74a813d853
• 209bb240-b919-11d1-bbb6-0080c75e4ec1
• 359e47c9-682e-11d0-adec-00c04fc2a078
• 386ffca4-22f5-4464-b660-be08692d7296
• 53e75790-d96b-11cd-ba18-08002b2dfead
• 56c8504c-4408-40fd-93fc-afd30f10c90d
• 5c89f409-09cc-101a-89f3-02608c4d2361
• 6bffd098-0206-0936-4859-199201201157
• 6e17aaa0-1a47-11d1-98bd-0000f875292e
• 7af5bbd0-6063-11d1-ae2a-0080c75e4ec1
• 7e048d38-ac08-4ff1-8e6b-f35dbab88d4a
• 82980780-4b64-11cf-8809-00a004ff3128
• 8d09b37c-9f3a-4ebb-b0a2-4dee7d6ceae9
• 93f5ac6f-1a94-4bc5-8d1b-fd44fc255089
• 9b3195fe-d603-43d1-a0d5-9072d7cde122
• a4c2fd60-5210-11d1-8fc2-00a024cb6019
• aa177641-fc9b-41bd-80ff-f964a701596f
• ce1334a5-41dd-40ea-881d-64326b23effe
• d2d79dfa-3400-11d0-b40b-00aa005ff586
• d7f9e1c0-2247-11d1-ba89-00c04fd91268
• e248d0b8-bf15-11cf-8c5e-08002bb49649
• e76ea56d-453f-11cf-bfec-08002be23f2f
• ec02cae0-b9e0-11d2-be62-0020afeddf63
• eff55e30-4ee2-11ce-a3c9-00aa00607271
• fc13257d-5567-4dea-898d-c6f9c48415a0
• ffe561b8-bf15-11cf-8c5e-08002bb49649

wcncsvc.dll RPC interfaces

Windows Connect Now - Config Registrar Service
WcnpRpc C100BEAB-D33A-4A4B-BF23-BBEF4663D017 version 1.0
0x1c methods

• WcnpRpcSubscribe
• WcnpRpcUnSubscribe
• WcnpRpcGetCachedPeers
• WcnpRpcAsyncGetNotification
• WcnpRpcCancelPendingNotification
• WcnpRpcPerformDiscovery
• WcnpRpcTargetedWlanDiscovery
• WcnpRpcGetPeerUuidFromTransportAddress
• WcnpRpcGetPeer
• WcnpRpcReleasePeer
• WcnpRpcPeerOpenSession
• WcnpRpcPeerGetAttribute
• WcnpRpcPeerGetAttributeAsInteger
• WcnpRpcPeerGetAttributeAsString
• WcnpRpcPeerGetVendorExtensions
• WcnpRpcSessionSetPassword
• WcnpRpcSessionSetProfileData
• WcnpRpcSessionSetProfilePassphrase
• WcnpRpcSessionConnect
• WcnpRpcSessionGetNotifications
• WcnpRpcSessionGetWirelessProfile
• WcnpRpcSessionGetAttributeAsInteger
• WcnpRpcReleaseSession
• WcnpRpcSessionSetVendorExtensions
• WcnpRpcSessionGetVendorExtensions
• WcnpRpcCreateManagementHandle
• WcnpRpcSetAdvertisementsEnabled
• WcnpRpcCloseManagementHandle

WcnTransportRpc C100BEAC-D33A-4A4B-BF23-BBEF4663D017 version 1.0
4 methods

• WcnSinkOpenHandle
• WcnSinkCloseHandle
• WcnSinkDeliverMessage
• WcnSinkAsyncGetNextAction

bdesvc.dll RPC interface

BitLocker Drive Encryption Service
BdeSvcApi AE55C4C0-64CE-11DD-AD8B-0800200C9A66 version 1.0
2 methods

• BdeSvcApipConversionEncrypt
• BdeSvcApipEventTrigger

wwansvc.dll RPC interfaces

WWAN Auto Config Service
winwwandiag D4254F95-08C3-4FCC-B2A6-0B651377A29D version 1.0
4 methods

• WWDiagQueryInfSnapShot
• WWDiagQueryInfRecentStats
• WWDiagQueryInfBulkStats
• WWDiagQueryInfSignalStrengthStats

winwwan D4254F95-08C3-4FCC-B2A6-0B651377A29C version 1.0
0x14 methods:

• WwanRpcOpenHandle
• WwanRpcCloseHandle
• WwanRpcRegisterNotification
• WwanRpcAsyncGetNotification
• WwanRpcEnumerateInterfaces
• WwanRpcSetInterface
• WwanRpcQueryInterface
• WwanRpcScan
• WwanRpcRegister
• WwanRpcConnect
• WwanRpcDisconnect
• WwanRpcSetSmsConfiguration
• WwanRpcSmsRead
• WwanRpcSmsSend
• WwanRpcSmsDelete
• WwanRpcSetProfile
• WwanRpcDeleteProfile
• WwanRpcGetProfile
• WwanRpcGetProfileList
• WwanRpcGetProfileIstream

Регистрируются в epmapper c annotation "Wwan Service"

wbiosrvc.dll RPC interfaces

Windows Biometric Service
WinBioCredentialManager 4BE96A0F-9F52-4729-A51D-C70610F118B0 version 1.0
6 methods

• WinBioCredMgrSrvSetCredential
• WinBioCredMgrSrvRemoveCredential
• WinBioCredMgrSrvRemoveAllCredentials
• WinBioCredMgrSrvRemoveAllDomainCredentials
• WinBioCredMgrSrvGetCredentialState
• WinBioSrvGetServiceMonitorEvent

WinBioServer C0E9671E-33C6-4438-9464-56B2E1B1C7B4 version 1.0
0x16 methods

• WinBioSrvEnumBiometricUnits
• WinBioSrvOpenSession
• WinBioSrvCloseSession
• WinBioSrvCancel
• WinBioSrvVerify
• WinBioSrvIdentify
• WinBioSrvLocateSensor
• WinBioSrvEnrollBegin
• WinBioSrvEnrollCapture
• WinBioSrvEnrollCommit
• WinBioSrvEnrollDiscard
• WinBioSrvEnumEnrollments
• WinBioSrvGetEvent
• WinBioSrvCaptureSample
• WinBioSrvDeleteTemplate
• WinBioSrvLockUnit
• WinBioSrvUnlockUnit
• WinBioSrvControlUnit
• WinBioSrvControlUnitPrivileged
• WinBioSrvGetProperty
• WinBioSrvLogonIdentifiedUser
• BioCredMgrGetLogonUserIdentity

Регистрируются в epmapper c annotation wbiosrvc
Висят на ALPC port 8765

keyiso.dll RPC interfaces

CNG Key Isolation Service
INCryptKeyIso B25A52BF-E5DD-4F4A-AEA6-8CA7272A0E86 version 1.0
0x1B methods

• SrvRpcCreateContext
• SrvRpcReleaseContext
• SrvRpcCryptOpenStorageProvider
• SrvRpcCryptIsAlgSupported
• SrvRpcCryptEnumAlgorithms
• SrvRpcCryptEnumKeys
• SrvRpcCryptFreeBuffer
• SrvRpcCryptFreeProvider
• SrvRpcCryptFreeKey
• SrvRpcCryptOpenKey
• SrvRpcCryptCreatePersistedKey
• SrvRpcCryptGetProviderProperty
• SrvRpcCryptSetProviderProperty
• SrvRpcCryptGetKeyProperty
• SrvRpcCryptSetKeyProperty
• SrvRpcCryptFinalizeKey
• SrvRpcCryptEncrypt
• SrvRpcCryptDecrypt
• SrvRpcCryptImportKey
• SrvRpcCryptExportKey
• SrvRpcCryptSignHash
• SrvRpcCryptVerifySignature
• SrvRpcCryptDeleteKey
• SrvRpcCryptNotifyChangeKey
• SrvRpcCryptSecretAgreement - название метода доставляет
• SrvRpcCryptDeriveKey
• SrvRpcCryptFreeSecret

Имеет место на следующих endpoints:

• named pipe PIPE\protected_storage
• named pipe pipe\lsass
• ALPC Port protected_storage
• ALPC Port audit
• ALPC Port samss lpc
• ALPC Port securityevent
• ALPC Port LSARPC_ENDPOINT
• ALPC Port lsasspirpc
• ALPC Port lsapolicylookup

Как можно догадаться - все вышеперечисленные endpoints принадлежат процессу lsass.exe

sspisrv.dll RPC interfaces

sspisrv.dll - LSA SSPI RPC interface DLL
sspirpc 4F32ADC8-6052-4A04-8701-293CCF2096F0 version 1.0
0x10 methods

•  SspirConnectRpc
•  SspirDisconnectRpc
•  SspirDisconnectRpcAsync
•  SspirCallRpc
•  SspirAcquireCredentialsHandle
•  SspirFreeCredentialsHandle
•  SspirProcessSecurityContext
•  SspirDeleteSecurityContext
•  SspirSslQueryCredentialsAttributes
•  SspirNegQueryContextAttributes
•  SspirSslSetCredentialsAttributes
•  SspirApplyControlToken
•  SspirLogonUser
•  SspirLookupAccountSid
•  SspirGetUserName
•  SspirGetInprocDispatchTable

Имеет место только в windows7 на следующих endpoints:

• ALPC Port lsapolicylookup
• ALPC Port securityevent
• ALPC Port audit
• ALPC Port protected_storage
• ALPC Port LSARPC_ENDPOINT
• ALPC Port lsasspirpc
• ALPC Port samss lpc