Browse Rules

RPC Activity

Microsoft Windows uses its implementation of [Distributed Computing Environment/Remote Procedure Call](https://en.wikipedia.org/wiki/DCE/RPC) (DCE/RPC), which it calls [Microsoft RPC](https://en.wikipedia.org/wiki/Microsoft_RPC), to call certain APIs remotely. A Remote Procedure Call is initiated by communicating to the RPC Endpoint Mapper, which exists as the Windows service RpcEptMapper and listens on the port 135/tcp. The endpoint mapper resolves a requested endpoint/interface and responds t

Potential Exploit via Fake RPC Messages

Identifies attempt to call memory manipulation APIs or load a library where call stack is pointing to the RPC function NdrServerCall2, this may indicate an attempt to exploit a vulnerability using fake RPC messages to bypass CFG mitigation.

Potential Browser Exploit via Fake RPC Messages

Identifies attempt to call memory manipulation APIs or load a library where call stack is pointing to the RPC function NdrServerCall, this may indicate an attempt to exploit a vulnerability using fake RPC messages to bypass CFG mitigation. A known example of vulnerability using this primitive is CVE-2021-26411.

Remote Windows Management Instrumentation (WMI) over RPC

As described in ATT&CK, an adversary can use [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to view or manipulate objects on a remote host. It can be used to remotely edit configuration, start services, query files, and anything that can be done with a WMI class. When remote WMI requests are over RPC ([CAR-2014-05-001](../CAR-2014-05-001)), it connects to a DCOM interface within the RPC group netsvcs. To detect this activity, a sensor is needed at the netwo

Remotely Scheduled Tasks via Schtasks

An adversary can [move laterally](https://attack.mitre.org/tactics/TA0008) using the `schtasks` command to remotely [schedule tasks/jobs](https://attack.mitre.org/techniques/T1053). Although these events can be detected with command line analytics [CAR-2013-08-001](../CAR-2013-08-001), it is possible for an adversary to use the API directly, via the Task Scheduler GUI or with a scripting language such as [PowerShell](https://attack.mitre.org/techniques/T1059/001). In this cases, an additional so