Executive Summary
Microsoft has expanded its Defender monitoring capabilities to provide deep visibility into Remote Procedure Call (RPC) activity, a protocol frequently abused by adversaries for remote execution and data extraction. By leveraging the Windows Filtering Platform (WFP), Defender can now audit specific RPC functions (OpNums) within interfaces such as Service Control Manager, Task Scheduler, and Remote Registry, even when the underlying transport is encrypted via SMB3.
This enhancement is critical for identifying common attack patterns used by toolkits like Impacket and SharpHound, including remote service creation and DCSync attacks. It specifically addresses visibility gaps in inbound remote RPC traffic, which historically required expensive network monitoring or was obscured by encryption.
For organizations, this update translates to improved detection of hands-on-keyboard activity and automated lateral movement. The telemetry is now available in Microsoft Defender Advanced Hunting, allowing SOC teams to proactively hunt for suspicious remote registry modifications and service installations across workstations and servers.