Microsoft Defender now monitors RPC activity

Remote procedure call (RPC) is a protocol commonly abused by attackers that allows functions implemented in a separate process, and potentially on a remote machine, to be called as if they were local. Many core Windows and Active Directory capabilities are built on or make use of RPC, which makes it an attractive target. To help protect against remote RPC-based attacks, Microsoft Defender now monitors remote RPC calls, disrupts malicious activity that leverages them, and surfaces relevant telemetry in advanced hunting.

RPC basics

While RPC is a rich and complicated protocol, the main components that are relevant for security monitoring purposes are:

1. Interface: A logical grouping of functionality exposed by an RPC server. Interfaces are identified by UUID. Example interfaces include Task Scheduler, Remote Registry, and the Service Control Manager, each exposing functionality related to a different Windows OS component.
2. OpNum: Stands for Operation Number, an ordinal that denotes a specific function exposed by an RPC interface. Examples include RCreateServiceW (OpNum 12, Service Control Manager interface) and BaseRegQueryValue (OpNum 17, Remote Registry interface).

Many remote attack techniques and tactics are based on RPC, for example:

1. Lateral movement: often abuses RPC functionality for remotely creating tasks, services or invoking WMI.
2. Credential theft: DCsync attacks, which abuse privileged compromised accounts to remotely extract credential material from Active Directory, are based on RPC functionality for directory replication. SecretsDump and similar attacks, which remotely extract SAM or LSA secrets, are based on querying a device’s registry remotely, using RPC.
3. Privilege escalation: Multiple authentication coercion attacks abuse benign RPC interfaces to coerce servers to authenticate an attacker.
4. Discovery: Tools such as SharpHound leverage RPC calls to enumerate users, sessions and shares.

For a more comprehensive mapping of RPC interfaces to attack techniques, see work by Jonathan Johnson.

RPC auditing in Defender

Since RPC is so heavily used on Windows systems and in Active Directory domains, monitoring remote RPC traffic using network monitors is often expensive and infeasible. Additionally, if the underlying transport protocol is encrypted (such as SMB3), it might be impossible to observe RPC traffic.

To enable efficient auditing of remote RPC activity regardless of transport-layer protection, Defender research and engineering expanded the existing RPC integration with the Windows Filtering Platform (WFP) to support OpNum-level granularity. This makes it possible to identify and audit the specific RPC function being invoked, rather than only the RPC interface.

This capability is designed to help detect remote RPC-based attack techniques, where an attacker interacts with RPC interfaces exposed by a target device. For that reason, Defender focuses this monitoring on inbound remote RPC calls observed on the RPC server host. The telemetry is collected using audit-only WFP filters, which do not interfere with normal traffic, while still providing visibility into suspicious remote activity targeting the device. This approach does not require visibility into the source device.

Local RPC calls, such as inter-process communication on the same device over local transport, and outbound RPC client calls are outside the scope of this monitoring mechanism.

Using this capability, Defender monitors selected RPC calls, leverages the resulting telemetry to detect malicious activity, and exposes monitored calls in advanced hunting. Defender dynamically monitors selected remote operations from interfaces including, but not limited to: Remote Registry, Service Control Manager, Task Scheduler, and Windows Management Instrumentation (WMI). RPC monitoring for workstations is generally available, while server monitoring is currently in gradual rollout.

RPC-based detections and disruption triggers are already available in Defender and include detections such as:

1. Ongoing hands-on-keyboard attack via Impacket toolkit
2. Suspicious service creation initiated remotely
3. Indication of local security authority secrets theft
4. Unusual RPC user and session discovery
5. Authentication coercion attack

Example Advanced Hunting queries

1. Remote registry key save events, abused for remote credential dumping.

let remoteRegistryInterface = '338cd001-2244-31f1-aaaa-900038001003'; 
let registrySaveOpnums = dynamic([20, 31]); // BaseRegSaveKey, BaseRegSaveKeyEx 
DeviceEvents 
| where ActionType == 'InboundRemoteRpcCall' 
| extend AdditionalFields = parse_json(AdditionalFields) 
| extend RpcInterface = tostring(AdditionalFields.RpcInterfaceUuid), OpNum = toint(AdditionalFields.RpcOpNum) 
| where RpcInterface == remoteRegistryInterface and OpNum in(registrySaveOpnums) 

2. Remote Service Creation events, could indicate lateral movement:

let remoteServicesInterface = '367abb81-9844-35f1-ad32-98f038001003'; 
let serviceCreationOpnums = dynamic([12, 24, 44, 45, 60]); // RCreateServiceW, RCreateServiceA, RCreateServiceWOW64A, RCreateServiceWOW64W, RCreateWowService 
DeviceEvents 
| where ActionType == 'InboundRemoteRpcCall' 
| extend AdditionalFields = parse_json(AdditionalFields) 
| extend RpcInterface = tostring(AdditionalFields.RpcInterfaceUuid), OpNum = toint(AdditionalFields.RpcOpNum) 
| where RpcInterface == remoteServicesInterface and OpNum in(serviceCreationOpnums) 

3. Session discovery events, could indicate account discovery:

let srvsvcInterface = '4b324fc8-1670-01d3-1278-5a47bf6ee188'; 
let netrSessionEnumOpnum = 12; 
DeviceEvents 
| where ActionType == 'InboundRemoteRpcCall' 
| extend AdditionalFields = parse_json(AdditionalFields) 
| extend RpcInterface = tostring(AdditionalFields.RpcInterfaceUuid), OpNum = toint(AdditionalFields.RpcOpNum) 
| where RpcInterface == srvsvcInterface and OpNum == netrSessionEnumOpnum 
| summarize dcount(DeviceId) by AccountName, AccountDomain, AccountSid 

Check out the advanced hunting tab to see monitored RPC activity in your environment and stay tuned for more updates from Defender.

Learn more

• To learn more about endpoint protection with Microsoft Defender, check out our website.
• To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.