Microsoft Defender for Endpoint now detects RPC protocol attacks

Key Takeaways

• Microsoft Defender for Endpoint now offers enhanced detection capabilities for attacks leveraging the Remote Procedure Call (RPC) protocol.
• This new functionality provides granular visibility into RPC operations, identifying specific functions invoked by attackers for lateral movement, credential theft, and privilege escalation.
• The monitoring focuses on inbound remote RPC calls on server hosts, addressing a long-standing blind spot in enterprise security.
• Active detections are already being rolled out, covering various attacker techniques, and security teams can access RPC telemetry via Advanced Hunting.

Microsoft Defender for Endpoint has significantly bolstered its threat detection capabilities, now specifically targeting attacks that exploit the Remote Procedure Call (RPC) protocol. This crucial Windows protocol has long been a favored mechanism for threat actors to achieve lateral movement, steal credentials, and escalate privileges within compromised networks.

RPC facilitates the execution of functions across different processes or even remote machines as if they were local. Given its fundamental role in many Windows and Active Directory functionalities, RPC presents an attractive and frequently abused attack surface in corporate environments.

Common attack techniques that leverage RPC include:

• Lateral Movement: Adversaries can remotely create tasks, services, or invoke Windows Management Instrumentation (WMI) through RPC interfaces.
• Credential Theft: Techniques like DCsync attacks exploit Active Directory replication RPC calls. Tools such as SecretsDump abuse the Windows Remote Registry interface (UUID: 338cd001-2244-31f1-aaaa-900038001003) to extract sensitive SAM and LSA secrets.
• Privilege Escalation: Authentication coercion attacks force servers to authenticate to systems controlled by the adversary via legitimate RPC interfaces.
• Discovery: Tools like SharpHound utilize RPC calls to enumerate users, sessions, and shares, mapping to MITRE ATT&CK techniques T1021, T1552.002, T1003.004, and T1003.

How Defender’s RPC Auditing Works

Historically, monitoring RPC traffic at the network layer has been challenging to scale and entirely ineffective when the underlying transport, such as SMB3, is encrypted. To overcome these limitations, Microsoft’s Defender research and engineering teams extended existing RPC integration with the Windows Filtering Platform (WFP).

This enhancement allows Defender to achieve OpNum-level granularity, meaning it can now identify the precise RPC function being called, not just the interface, without intercepting or disrupting normal network traffic. The monitoring primarily focuses on inbound remote RPC calls observed on the server host, specifically targeting interactions initiated by attackers with exposed RPC interfaces. Local and outbound RPC calls remain outside the scope of this new capability.

Defender dynamically monitors selected remote operations from critical interfaces, including Remote Registry, Service Control Manager, Task Scheduler, and Windows Management Instrumentation (WMI). This RPC monitoring is now generally available for workstations and is being progressively rolled out to servers. Existing detections already shipping include:

• Identification of ongoing hands-on-keyboard attacks leveraging the Impacket toolkit.
• Detection of suspicious remote service creation, indicative of lateral movement.
• Alerts for potential theft of Local Security Authority (LSA) secrets.
• Detection of unusual RPC-based user and session discovery activities.
• Identification of authentication coercion attacks.

Security teams can directly query RPC telemetry using the InboundRemoteRpcCall action type within DeviceEvents in the Advanced Hunting tab. Microsoft has provided examples demonstrating how analysts can hunt for remote registry key save events (OpNums 20/31 on interface 338cd001) and remote service creation events (OpNums 12, 24, 44, 45, 60 on interface 367abb81). These events are frequently associated with credential dumping and lateral movement toolkits like Impacket.

This significant enhancement grants defenders unprecedented visibility into a previously opaque yet highly abused attack vector within Windows environments, directly accessible through the Microsoft Defender portal.

What You Should Do

• Ensure Microsoft Defender for Endpoint is deployed and up-to-date across all workstations and servers.
• Familiarize your security operations center (SOC) team with the new RPC telemetry available in the Advanced Hunting tab.
• Develop custom hunting queries or alerts for specific RPC activities that might indicate malicious behavior in your environment.
• Regularly review Defender alerts related to RPC activity and investigate any suspicious detections promptly.
• Implement strong authentication and access control policies to limit the potential impact of RPC abuse.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.