Port 135 is the Microsoft RPC Endpoint Mapper service used to locate RPC endpoints on Windows systems. Attackers often probe it to discover exposed services and move laterally through Windows management interfaces. Defenders should restrict exposure, monitor for scanning and unusual RPC traffic, and limit access from untrusted networks.
What Port 135 Means in Windows Environments
Port 135 is the RPC Endpoint Mapper, so its security significance is less about a single application and more about how Windows systems advertise and discover RPC services. That makes it a common entry point for enumeration, service discovery, and trust-boundary mistakes.
Because the mapper helps clients find dynamic RPC endpoints, defenders should treat it as an exposure surface that can reveal more than intended if it is reachable from untrusted networks. Port exposure also matters because scanning it can quickly identify whether Windows management interfaces are present and reachable.
Why Port 135 Is Attractive to Attackers
Attackers probe port 135 to map out RPC-capable services, identify useful management paths, and look for lateral movement opportunities. In practice, the endpoint mapper can function as a discovery layer that helps an intruder decide which Windows interfaces are worth targeting next.
That is why port 135 is often discussed alongside Windows administration protocols and remote management exposure. If the host is reachable where it should not be, the port becomes a reconnaissance aid even before any higher-value service is accessed.
Exposure, Segmentation, and Monitoring
The main defensive question is whether port 135 needs to be reachable at all outside the networks that genuinely depend on RPC. Restricting exposure is usually more effective than relying on detection alone, especially in environments where Windows hosts are broadly connected across flat internal networks.
Monitoring should look for repeated connection attempts, unusual source networks, and RPC traffic patterns that do not match the normal administration profile. For a broader reference on risky ports and protocol exposure, see the Network Ports and Protocols Security Guide, which covers common services that should not remain open by default.
Controlling RPC Reachability and Validation
Defending port 135 is usually a combination of network restriction, host hardening, and disciplined service inventory. Organisations should know which Windows systems need RPC exposure, which subnets can legitimately reach them, and whether the exposed services are still required.
When validating exposure, use asset inventory, firewall policy review, and vendor or platform guidance to confirm whether the endpoint mapper is intentionally available. For protocol registration and port assignment context, the IANA registry is useful for understanding how ports are formally managed, even though the defensive decision here is driven by your own environment and Windows requirements.
Risk and Threat Considerations
Port 135 is risky because it can disclose enough RPC surface area to accelerate reconnaissance and support lateral movement once an attacker has any foothold. If exposed to untrusted networks, it can turn a Windows management dependency into an inventory source for adversaries.
Failure mechanism: The endpoint mapper is reachable where it should be blocked, letting scanners enumerate RPC-related services and helping attackers pivot toward remote administration paths.
Impact: Increased discovery of internal services, faster movement between Windows hosts, and greater chance that exposed management interfaces become part of a broader intrusion chain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Port 135 exposure is a network boundary issue that needs controlled reachability. |
| SI-4 — System Monitoring | Monitoring for scans and unusual RPC traffic aligns with continuous detection of suspicious activity. | |
| Recommendation — Restrict RPC exposure with boundary controls and limit access to trusted management networks. Monitor port 135 for scanning, abnormal source networks, and unusual RPC connection patterns. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Managing exposed ports and trusted pathways is a core network infrastructure control. |
| CIS-13 — Network Monitoring and Defense | Detecting probes and anomalous RPC traffic requires active network monitoring. | |
| Recommendation — Document and restrict RPC reachability across network segments and firewall rules. Alert on repeated endpoint mapper probes and suspicious RPC traffic patterns. | ||
| NIST CSF 2.0 | PR.AA-05 — Network Integrity | Network integrity depends on limiting unnecessary service exposure to untrusted sources. |
| Recommendation — Limit network exposure of RPC services to reduce discovery and lateral movement risk. | ||
Practitioner Guidance
What to watch for: Treat port 135 as a control point, not a standalone service to leave broadly accessible. The practical decision is whether each exposed listener is justified by a documented operational need, and whether its reach is tightly limited to the systems that actually use it.
Practitioner takeaway: If port 135 is visible beyond a trusted management segment, assume the rest of the Windows RPC surface is easier to discover and tighten the boundary first.