Remote Session Discovery via RPC (srvsvc OpNum 12)

Ethan Andrews@eandrews

•updated Jun 10, 2026•6•0•16

Identifies inbound remote RPC calls for network session enumeration (OpNum 12) via the srvsvc interface. This is often utilized by discovery tools like SharpHound for Active Directory reconnaissance.