Inter-Process Communication - RPC Endpoint Mapper High Volume

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects a high volume of Inter-Process Communication (IPC) activity targeting the RPC Endpoint Mapper on the home network. Specifically, it triggers an alert if more than 30 TCP connections to port 135 (RPC Endpoint Mapper) are observed from a single source IP within a 10-second window. This could indicate an attempt to enumerate services or exploit vulnerabilities related to RPC.