Port :135DCE/RPC Endpoint Mapper

Common Vulnerabilities

• Exposure of Port 135 can enable network reconnaissance and enumeration, aiding attackers in identifying available RPC services for exploitation.
• Exploitable attack surface for vulnerabilities like MS03-026 (Blaster worm) and MS08-067 (Conficker worm), both targeting flaws in RPC services.
• Allows for lateral movement if exploited, providing access to sensitive Windows services such as SMB sharing and remote management.
• Can be leveraged in denial of service attacks, causing disruptions to RPC-dependent services.

Common Mitigations

• Restrict access to port 135 at network boundaries using firewalls or access control lists, especially from untrusted networks.
• Apply the latest security patches to RPC services and Windows systems to mitigate known vulnerabilities.
• Use host-based firewalls to limit RPC exposure on endpoints.
• Implement network segmentation to isolate critical systems, minimizing lateral movement.
• Prefer secure alternatives or tunnels (e.g., VPNs) when remote RPC management is required, avoiding direct exposure.
• Leverage intrusion detection and monitoring for unusual activity patterns associated with RPC use or exploitation.