RPC Remote Execution Attempt - High Volume

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects a high volume of TCP connection attempts to port 135 (RPC) on the home network. A threshold of 20 connection attempts from a single source within 30 seconds triggers the alert. This pattern can indicate an attempt to exploit RPC services for remote execution, often seen in worm propagation or targeted attacks.