DCOM Remote Execution via RPC Endpoint Mapper

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects DCOM remote execution attempts via the RPC Endpoint Mapper. It specifically looks for TCP traffic to port 135 (RPC Endpoint Mapper) with a specific content signature "|05 00 0b|" within the first 3 bytes of the payload, indicating a DCOM activation request.