Management & monitoringTCP 135 Encrypted
Port 135: MS-RPC
Microsoft RPC Endpoint Mapper
Directs Windows remote procedure calls to dynamic high ports. Used heavily by Windows management tools.
How attackers abuse it
- Remote service and task creation for lateral movement.
- Enumeration of domain information.
How to defend it
- Block from the internet and between workstations.
- Host firewalls allowing RPC only from management hosts.
Exam tip
Workstation-to-workstation RPC and SMB are rarely needed and are prime lateral-movement paths.