Blog Post

Microsoft Defender for Endpoint Blog

4 MIN READ

Microsoft Defender now monitors RPC activity

EdanZwick

Microsoft

Jun 08, 2026

Microsoft Defender now monitors remote RPC activity from select interfaces and supports detection, disruption, and hunting over RPC call data.

Remote procedure call (RPC) is a protocol commonly abused by attackers that allows functions implemented in a separate process, and potentially on a remote machine, to be called as if they were local...

Updated Jun 09, 2026

Version 3.0

microsoft defender for endpoint

EdanZwick

Microsoft

Joined November 07, 2019

View Profile

Microsoft Defender for Endpoint Blog

Microsoft Defender for Endpoint disrupts ransomware with industry-leading endpoint security, providing comprehensive protection across all platforms and devices.

HotCakeX

MVP

Jun 08, 2026

This is very useful. Will it be automatically enabled after a certain engine version or do we have to enable it on workstations via WMI/policy?

EdanZwick

Microsoft

Jun 08, 2026

It will be automatically enabled on all devices with a compatible version. We’ll add an update on supported versions.