Microsoft has expanded its Microsoft Defender platform to monitor inbound remote procedure call (RPC) activity, enabling detection, attack disruption, and advanced hunting across RPC call data, closing a long-standing visibility gap that attackers have routinely exploited to execute lateral movement, credential theft, and privilege escalation.
Remote Procedure Call (RPC) is a foundational Windows protocol that allows functions in a separate process and potentially on a remote machine to be invoked as if they were local.
Because core Windows features like the Service Control Manager, Task Scheduler, Remote Registry, and Active Directory replication all rely on RPC, attackers have long targeted it as a reliable abuse vector.
Microsoft Defender Adds Detection
Two components are central to RPC security monitoring. The Interface, identified by a UUID, represents a logical grouping of functionality exposed by an RPC server (e.g., Remote Registry or WMI).
The OpNum (Operation Number) identifies the specific function being called within that interface, such as BaseRegQueryValue (OpNum 17) or RCreateServiceW (OpNum 12).
Several high-impact attack techniques weaponize RPC in the wild:
- Lateral movement — Attackers remotely create tasks, services, or invoke WMI over RPC
- Credential theft — DCsync abuses Active Directory replication RPC; SecretsDump and similar tools remotely query the registry via the Windows Remote Registry interface
- Privilege escalation — Authentication coercion attacks abuse benign RPC interfaces to force servers to authenticate to attacker-controlled resources
- Discovery — Tools like SharpHound enumerate users, sessions, and shares using RPC calls
Because monitoring raw RPC traffic via network sensors is expensive and breaks down entirely when transport encryption (such as SMB3) is in use, Microsoft took a different approach.
Defender’s research and engineering team extended the platform’s existing integration with the Windows Filtering Platform (WFP) to achieve OpNum-level granularity, enabling Defender to pinpoint the exact RPC function being called, not just the interface.
The telemetry is collected using audit-only WFP filters, which passively observe inbound remote RPC calls on the server host without interfering with legitimate traffic.
This design requires no visibility into the source device, making it practical at scale. Local RPC calls and outbound client calls are explicitly outside the scope of this monitoring.
Microsoft stated that RPC monitoring for workstations is now generally available, while server-side monitoring is currently undergoing a gradual rollout.
Detection
Defenders can take immediate advantage of active detections that leverage the new RPC telemetry, including:
- Ongoing hands-on-keyboard attacks via the Impacket toolkit
- Suspicious remote service creation
- Indication of local security authority (LSA) secrets theft mapped to MITRE T1003.004
- Unusual RPC-based user and session discovery
- Authentication coercion attacks
The new InboundRemoteRpcCall action type in the DeviceEvents table surfaces the monitored data directly in Microsoft Defender’s Advanced Hunting interface.
Security teams can query for remote registry save events (OpNums 20 and 31 on interface 338cd001-2244-31f1-aaaa-900038001003) indicative of credential dumping, or for remote service creation events (OpNums 12, 24, 44, 45, 60 on the interface 367abb81-9844-35f1-ad32-98f038001003) that may signal lateral movement.
Session discovery via NetrSessionEnum (OpNum 12 on the srvsvc interface) can be aggregated by account to detect reconnaissance tools like SharpHound.
The screenshots above, shared alongside the announcement, show these KQL queries in action within the Advanced Hunting console and the corresponding alert story triggered by a DomainAdmin account invoking BaseRegQueryValue a telltale sign of remote LSA secrets theft.
Microsoft recommends that security teams visit the Advanced Hunting tab to review monitored RPC activity in their environments and monitor for additional Defender updates as server-side rollout continues.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 activity, enabling detection, attack disruption, and advanced hunting across RPC call data, closing a long-standing visibility gap that attackers have routinely exploited to execute lateral movement, credential theft, and privilege escalation.){kind=link}