DCERPC

DCE/RPC (Distributed Computing Environment / Remote Procedure Calls) is the RPC implementation that Windows inherited from the Open Group’s DCE standard and built its management plane on. Most Windows remote administration — services, tasks, registry, shares, SAMR/LSARPC account operations — is a DCE/RPC conversation over named pipes or TCP, which is why understanding it matters for both lateral movement and detection.

Shape of the protocol

• Client and server exchange PDUs (Protocol Data Units) over a transport: SMB named pipes (\pipe\samr, \pipe\svcctl, etc.), TCP port 135 (the Endpoint Mapper), or dynamically assigned high ports.
• The Endpoint Mapper (EPM) on TCP 135 answers “which port hosts interface X?” — the first thing any RPC client (or scanner) touches.
• Interfaces are identified by UUIDs; operations within an interface by opnum. Tooling like Impacket’s rpcclient, wmiexec, psexec, and CrackMapExec all speak DCE/RPC under the hood.
• Authentication rides on the transport (SMB session setup, Kerberos/NTLM), so an authenticated DCE/RPC session inherits the caller’s token — the mechanism behind wmi-remote-service-execution and most PsExec-style tooling.

Why it matters for offense and defense

• Offense: DCE/RPC is the substrate for remote service creation (svcctl), scheduled tasks (atsvc/tsch), SAMR user enumeration, and printer/spooler coercion (PetitPotam). An allow-any RPC policy on a domain controller is functionally an allow-any administration policy.
• Defense: restricting DCE/RPC via host firewall rules (RPC filtering, netsh rpc filter) or network segmentation is one of the highest-leverage hardening steps; Microsoft’s RPC firewall filters can permit specific UUIDs/opnums rather than the all-or-nothing port-135 approach. See netsh-windows-firewall for the firewall side.- MITRE ATT&CK technique T1021.002 (SMB/Windows Admin Shares) and T1047 (WMI, which layers DCOM over RPC) both traverse DCE/RPC.

Sources

• The Open Group — DCE 1.1: Remote Procedure Call (C706)
• Microsoft Learn — Remote Procedure Call (RPC)
• MITRE ATT&CK T1021.002 — SMB/Windows Admin Shares

Related: wmi-remote-service-execution, netsh-windows-firewall, windows-services, ntlm-relay-attacks, exploit-windows-scheduled-tasks, wmi-powershell-sessions