RPCFW

Event	Title	Channel	Sample	Rule
1	RPC Firewall protection added.	RPCFW	Y	N
2	RPC Firewall protection removed.	RPCFW	Y	N
3	An RPC server function was called.	RPCFW	Y	Y

Event ID 1: RPC Firewall protection added.

Channel: RPCFW

Fields #

Name	Description
`Data_0`	Full image path of the RPC server process that was protected
`Data_1`	Process ID (PID) of the protected process
`Binary`

Example Event #

{
  "system": {
    "provider": "RPCFW",
    "guid": "",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 45035996273704960,
    "time_created": "2026-03-12T02:57:48.895060+00:00",
    "event_record_id": 101847,
    "correlation": {},
    "execution": {
      "process_id": 5912,
      "thread_id": 0
    },
    "channel": "RPCFW",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "C:\\Windows\\system32\\svchost.exe",
    "Data_1": "5912",
    "Binary": ""
  },
  "message": ""
}

Event ID 2: RPC Firewall protection removed.

Channel: RPCFW

Fields #

Name	Description
`Data_0`	Full image path of the RPC server process that was unprotected
`Data_1`	Process ID (PID) of the unprotected process
`Binary`

Example Event #

{
  "system": {
    "provider": "RPCFW",
    "guid": "",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 45035996273704960,
    "time_created": "2026-03-12T02:59:48.113235+00:00",
    "event_record_id": 101898,
    "correlation": {},
    "execution": {
      "process_id": 5912,
      "thread_id": 0
    },
    "channel": "RPCFW",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "C:\\Windows\\system32\\svchost.exe",
    "Data_1": "5912",
    "Binary": ""
  },
  "message": ""
}

Event ID 3: An RPC server function was called.

Channel: RPCFW

Fields #

Name	Description
`Data_0`	Name of the hooked RPCRT4 function that was called
`Data_1`	Process ID (PID) of the RPC server process handling the call
`Data_2`	Full image path of the RPC server process
`Data_3`	RPC protocol sequence used by the client (e.g. ncacn_np, ncacn_ip_tcp)
`Data_4`	RPC endpoint the server is listening on (e.g. \PIPE\wkssvc)
`Data_5`	Client network address (IP or hostname for named pipe connections)
`Data_6`	RPC interface UUID identifying the service being called
`Data_7`	RPC operation number (function ordinal within the interface)
`Data_8`	Authenticated client principal name (UNKNOWN if no authentication)
`Data_9`	RPC authentication level (e.g. NONE, CONNECT, PKT_PRIVACY)
`Data_10`	RPC authentication service (e.g. KERBEROS, NEGOTIATE, WINNT)
`Data_11`	Client source port number
`Data_12`	Server network address (defaults to 0.0.0.0 if not determinable)
`Data_13`	Server destination port number
`Data_14`	Windows Security Identifier (SID) of the authenticated caller
`Binary`

Example Event #

{
  "system": {
    "provider": "RPCFW",
    "guid": "",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 45035996273704960,
    "time_created": "2026-03-12T03:05:47.938130+00:00",
    "event_record_id": 102054,
    "correlation": {},
    "execution": {
      "process_id": 2640,
      "thread_id": 0
    },
    "channel": "RPCFW",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "NdrStubCall2",
    "Data_1": "2640",
    "Data_2": "C:\\Windows\\System32\\svchost.exe",
    "Data_3": "ncacn_np",
    "Data_4": "\\\\PIPE\\\\wkssvc",
    "Data_5": "LAB-WIN11",
    "Data_6": "6bffd098-a112-3610-9833-46c3f87e345a",
    "Data_7": "3",
    "Data_8": "UNKNOWN",
    "Data_9": "UNKNOWN",
    "Data_10": "UNKNOWN",
    "Data_11": "0",
    "Data_12": "0.0.0.0",
    "Data_13": "0",
    "Data_14": "S-1-5-21-3407486967-1585450050-1838039599-1000",
    "Binary": ""
  },
  "message": ""
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventLog`	eq	`rpcfw`	17 rules	sigma
`OpNum`	eq	`1`	3 rules	sigma
`OpNum`	eq	`0`	2 rules	sigma
`OpNum`	eq	`12`	2 rules	sigma
`OpNum`	eq	`13`	2 rules	sigma
`InterfaceUuid`	eq	`1ff70682-0a51-30e8-076d-740be8cee98b`	2 rules	sigma
`InterfaceUuid`	eq	`338cd001-2244-31f1-aaaa-900038001003`	2 rules	sigma
`InterfaceUuid`	eq	`378e52b0-c0a9-11cf-822d-00aa0051e40f`	2 rules	sigma
`InterfaceUuid`	eq	`4b324fc8-1670-01d3-1278-5a47bf6ee188`	2 rules	sigma
`InterfaceUuid`	eq	`86d35949-83c9-4044-b424-db363231fd0c`	2 rules	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Remote Schedule Task Lateral Movement via ATSvc source high: Detects remote RPC calls to create or execute a scheduled task via ATSvcT1053, T1053.002
Remote Schedule Task Recon via AtScv source high: Detects remote RPC calls to read information about scheduled tasks via AtScv
Possible DCSync Attack source high: Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.T1033

Show 14 more (17 total) on the rules page