Microsoft Defender now monitors RPC abuse used in Windows attacks

Microsoft Defender can now monitor remote RPC activity that attackers often abuse during Windows network intrusions. The new capability helps defenders detect suspicious RPC-based activity tied to lateral movement, credential theft, discovery, and authentication coercion.

The change was announced in a Microsoft Defender update published on June 8, 2026. Microsoft says Defender can now monitor remote RPC calls, disrupt malicious activity that uses them, and surface related telemetry for advanced hunting.

BEST SPRING 2026 DEALS

Editor's Choice

Private Internet Access

Access content across the globe at the highest speed rate.

70% of our readers choose Private Internet Access

70% of our readers choose ExpressVPN

ExpressVPN

Browse the web from multiple devices with industry-standard security protocols.

Nord VPN

Faster dedicated servers for specific actions (currently at summer discounts)

RPC, or Remote Procedure Call, lets one process call a function exposed by another process, including on a remote machine. Windows and Active Directory rely heavily on RPC, which makes it useful for administrators but also attractive to attackers.

What Microsoft Defender now sees in RPC traffic

Microsoft expanded Defender’s existing RPC integration with the Windows Filtering Platform so it can inspect RPC activity with OpNum-level detail. In simple terms, Defender can now identify the exact function being called through a monitored RPC interface, not only the interface itself.

This matters because many legitimate and malicious actions can use the same RPC interface. Function-level visibility gives security teams a better way to tell routine administrative activity from behavior that may indicate an active compromise.

Microsoft says the telemetry focuses on inbound remote RPC calls observed on the target device. Local RPC calls and outbound RPC client activity are outside the scope of this monitoring. The company also said RPC monitoring for workstations is generally available, while server monitoring is rolling out gradually.

Why OpNum-level monitoring matters

RPC interfaces are identified by UUIDs. Each interface can expose many operations, and each operation has an OpNum, or operation number. Microsoft’s update gives Defender the ability to observe selected remote operations at that more precise level.

For example, Microsoft highlighted scenarios involving the Remote Registry interface and the Service Control Manager interface. Remote Registry activity can be linked to credential dumping, while suspicious remote service creation can point to lateral movement.

Traditional network monitoring can struggle with RPC because the protocol is widely used and can create noisy traffic. Microsoft also notes that network-layer monitoring may lose visibility when the underlying transport, such as SMB3, is encrypted. Host-based telemetry helps close that gap.

• Defender can monitor selected remote RPC operations on critical interfaces.
• Microsoft highlighted Remote Registry, Service Control Manager, Task Scheduler, and WMI as important areas.
• Built-in detections already cover activity linked to Impacket, suspicious remote service creation, LSA secrets theft, user and session discovery, and authentication coercion.
• The update gives analysts more useful telemetry without requiring them to inspect every RPC packet on the network.

How security teams can hunt RPC activity

Security teams can review the new RPC telemetry in Microsoft Defender’s Advanced Hunting experience. Microsoft says the relevant events appear in the DeviceEvents table through the InboundRemoteRpcCall action type.

The Microsoft Learn DeviceEvents table explains that DeviceEvents contains miscellaneous device events, including events triggered by security controls such as Microsoft Defender Antivirus and exploit protection. For RPC investigations, analysts can use this table to query monitored inbound remote RPC calls and correlate them with other endpoint activity.

Microsoft’s examples include hunting for remote registry key save events on the Remote Registry interface and remote service creation events on the Service Control Manager interface. These patterns can help identify attacks that use tools such as Impacket or techniques mapped to the MITRE ATT&CK Remote Services technique.

What admins should do next

The new telemetry gives defenders more visibility, but it should support existing security controls rather than replace them. Organizations should still limit administrative access, harden remote management paths, monitor privileged accounts, and investigate unexpected remote service creation.

Admins should also check whether the new events appear in their Defender environment and build hunting queries around remote registry access, remote service creation, unusual session enumeration, and authentication coercion attempts.

The update is especially useful for organizations that already use Microsoft Defender for Endpoint and Advanced Hunting as part of their security operations workflow. It gives analysts a clearer view of a Windows protocol that attackers have abused for years because it often blends into normal administrative traffic.

FAQ