Microsoft Defender Adds Monitoring for RPC Protocol Abuse in Cyberattacks

Microsoft announced enhanced monitoring in Defender for Endpoint that inspects inbound remote RPC calls at the operation-number (OpNum) level via audit-only Windows Filtering Platform filters, providing function-level visibility into RPC activity. The feature surfaces detailed telemetry in Advanced Hunting, includes built-in detections and automated disruption for several RPC-based techniques (e.g., remote service creation, Remote Registry credential dumping, session enumeration, authentication coercion), and is available for workstations with server rollout ongoing.