Detection of Unauthorized RPC Traffic to the Internet

Remote Procedure Call (RPC) is a fundamental protocol used for system administration, resource sharing, and cross-system management. While essential for internal operations, RPC services (particularly on port 135) should never be directly exposed to the public Internet. Threat actors frequently scan for and target exposed RPC interfaces to achieve initial access, deploy backdoors, or facilitate lateral movement within compromised environments. This detection focuses on identifying traffic originating from internal IP ranges (RFC 1918) that is destined for external, non-private IP space. Defenders should treat such telemetry as high-fidelity evidence of potential misconfiguration or active unauthorized remote access.

Attack Chain

1. Attacker performs reconnaissance to identify exposed RPC endpoints (e.g., port 135) on the target organization's internet-facing assets.
2. Attacker interacts with the RPC endpoint to identify services, versions, or potential vulnerabilities present on the host.
3. Attacker leverages a remote exploitation technique against the service (e.g., buffer overflow or deserialization flaw).
4. Upon successful exploitation, the attacker executes arbitrary commands or uploads a web shell/backdoor.
5. The compromised system initiates an outbound RPC connection to an attacker-controlled listener or C2 node to finalize the connection.
6. Attacker utilizes the established connection for lateral movement, credential theft, or exfiltration of sensitive internal data.

Impact

Successful exploitation of exposed RPC services can result in full system compromise, unauthorized access to sensitive data, and the establishment of persistent backdoors. These attacks facilitate further network intrusion, potentially impacting an entire organization's infrastructure by enabling lateral movement across sensitive segments.

Recommendation

Prioritize the investigation of any internal host generating RPC traffic (TCP port 135 or DCE/RPC traffic) directed toward external IP space.

• Implement the provided Sigma rule to flag anomalous RPC traffic patterns in network security logs.
• Review network egress filtering policies to explicitly block inbound and outbound traffic on RPC-associated ports at the network perimeter.
• Isolate systems identified by this detection and investigate for unauthorized installed services or modifications.
• Validate that all internal services requiring RPC for cross-system management are configured to only communicate over authorized internal VPNs or secure management subnets.