Microsoft Defender now monitors RPC activity

Source: Microsoft Defender for Endpoint Blog articles

Author: EdanZwick

URL: https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/microsoft-defender-now-monitors-rpc-activity/4523368

https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/microsoft-defender-now-monitors-rpc-activity/4523368

ONE SENTENCE SUMMARY:

Microsoft Defender now audits inbound remote RPC calls at OpNum granularity to detect, disrupt, and hunt common Windows attacks.

MAIN POINTS:

1. Remote procedure call enables invoking remote functions as if executed locally.
2. Windows and Active Directory rely heavily on RPC, making it a frequent attacker target.
3. RPC interfaces group server functionality and are identified by UUIDs.
4. OpNum uniquely identifies the specific function invoked within an RPC interface.
5. Lateral movement commonly abuses RPC for remote tasks, services, and WMI execution.
6. Credential theft includes DCSync replication abuse and remote registry-based secrets dumping.
7. Privilege escalation can involve authentication coercion through legitimate RPC interfaces.
8. Discovery tooling like SharpHound enumerates users, sessions, and shares via RPC calls.
9. Defender uses Windows Filtering Platform integration to audit remote RPC even with encrypted transports.
10. Telemetry targets inbound server-side remote RPC only; local and outbound RPC are excluded.

TAKEAWAYS:

1. OpNum-level visibility improves detection precision beyond interface-only monitoring.
2. Audit-only WFP filters provide scalable RPC telemetry without disrupting normal traffic.
3. Hunting data enables investigations of remote registry saves, service creation, and session discovery.
4. Built-in detections cover Impacket activity, secrets theft indicators, and coercion attempts.
5. Workstation RPC monitoring is GA, while server coverage is gradually rolling out.