Microsoft Defender now monitors RPC abuse used in Windows attacks
5 min. read 
Published on
Microsoft Defender can now monitor remote RPC activity that attackers often abuse during Windows network intrusions. The new capability helps defenders detect suspicious RPC-based activity tied to lateral movement, credential theft, discovery, and authentication coercion.
The change was announced in a Microsoft Defender update published on June 8, 2026. Microsoft says Defender can now monitor remote RPC calls, disrupt malicious activity that uses them, and surface related telemetry for advanced hunting.
Access content across the globe at the highest speed rate.
70% of our readers choose Private Internet Access
70% of our readers choose ExpressVPN
Browse the web from multiple devices with industry-standard security protocols.
Faster dedicated servers for specific actions (currently at summer discounts)
RPC, or Remote Procedure Call, lets one process call a function exposed by another process, including on a remote machine. Windows and Active Directory rely heavily on RPC, which makes it useful for administrators but also attractive to attackers.
What Microsoft Defender now sees in RPC traffic
Microsoft expanded Defender’s existing RPC integration with the Windows Filtering Platform so it can inspect RPC activity with OpNum-level detail. In simple terms, Defender can now identify the exact function being called through a monitored RPC interface, not only the interface itself.
This matters because many legitimate and malicious actions can use the same RPC interface. Function-level visibility gives security teams a better way to tell routine administrative activity from behavior that may indicate an active compromise.
Microsoft says the telemetry focuses on inbound remote RPC calls observed on the target device. Local RPC calls and outbound RPC client activity are outside the scope of this monitoring. The company also said RPC monitoring for workstations is generally available, while server monitoring is rolling out gradually.
| Attack area | How attackers use RPC | Why Defender visibility helps |
| Lateral movement | Attackers can create remote services, scheduled tasks, or use WMI through RPC. | Security teams can spot suspicious remote activity linked to movement across systems. |
| Credential theft | Tools can abuse Remote Registry or Active Directory replication calls to access sensitive secrets. | Defender can surface activity associated with remote registry access and LSA secrets theft. |
| Discovery | Attackers can enumerate users, sessions, and shares through RPC calls. | Analysts can hunt for unusual enumeration patterns across devices and accounts. |
| Remote services abuse | RPC can support behavior mapped to the MITRE ATT&CK Remote Services technique. | Teams can connect RPC telemetry with known attacker techniques and investigation workflows. |
Why OpNum-level monitoring matters
RPC interfaces are identified by UUIDs. Each interface can expose many operations, and each operation has an OpNum, or operation number. Microsoft’s update gives Defender the ability to observe selected remote operations at that more precise level.
For example, Microsoft highlighted scenarios involving the Remote Registry interface and the Service Control Manager interface. Remote Registry activity can be linked to credential dumping, while suspicious remote service creation can point to lateral movement.
Traditional network monitoring can struggle with RPC because the protocol is widely used and can create noisy traffic. Microsoft also notes that network-layer monitoring may lose visibility when the underlying transport, such as SMB3, is encrypted. Host-based telemetry helps close that gap.
- Defender can monitor selected remote RPC operations on critical interfaces.
- Microsoft highlighted Remote Registry, Service Control Manager, Task Scheduler, and WMI as important areas.
- Built-in detections already cover activity linked to Impacket, suspicious remote service creation, LSA secrets theft, user and session discovery, and authentication coercion.
- The update gives analysts more useful telemetry without requiring them to inspect every RPC packet on the network.
How security teams can hunt RPC activity
Security teams can review the new RPC telemetry in Microsoft Defender’s Advanced Hunting experience. Microsoft says the relevant events appear in the DeviceEvents table through the InboundRemoteRpcCall action type.
The Microsoft Learn DeviceEvents table explains that DeviceEvents contains miscellaneous device events, including events triggered by security controls such as Microsoft Defender Antivirus and exploit protection. For RPC investigations, analysts can use this table to query monitored inbound remote RPC calls and correlate them with other endpoint activity.
Microsoft’s examples include hunting for remote registry key save events on the Remote Registry interface and remote service creation events on the Service Control Manager interface. These patterns can help identify attacks that use tools such as Impacket or techniques mapped to the MITRE ATT&CK Remote Services technique.
What admins should do next
The new telemetry gives defenders more visibility, but it should support existing security controls rather than replace them. Organizations should still limit administrative access, harden remote management paths, monitor privileged accounts, and investigate unexpected remote service creation.
Admins should also check whether the new events appear in their Defender environment and build hunting queries around remote registry access, remote service creation, unusual session enumeration, and authentication coercion attempts.
The update is especially useful for organizations that already use Microsoft Defender for Endpoint and Advanced Hunting as part of their security operations workflow. It gives analysts a clearer view of a Windows protocol that attackers have abused for years because it often blends into normal administrative traffic.
FAQ
Microsoft added monitoring for selected inbound remote RPC calls. Defender can now surface RPC telemetry in Advanced Hunting and use it to detect or disrupt suspicious activity tied to attacks such as lateral movement and credential theft.
No. Microsoft says the feature focuses on inbound remote RPC calls observed on the target device. Local RPC calls and outbound RPC client activity are outside the scope of this monitoring.
Attackers abuse RPC because many Windows and Active Directory features rely on it. They can use RPC-related activity for remote service creation, WMI activity, credential theft, account discovery, session enumeration, and authentication coercion.
Security teams can query the telemetry in Microsoft Defender Advanced Hunting. The relevant action type is InboundRemoteRpcCall in the DeviceEvents table.
Microsoft says RPC monitoring for workstations is generally available. Server monitoring is currently being rolled out gradually.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages