What attacks target port 135 (RPC)?

What attackers do with port 135

Port 135 is the endpoint mapper for Microsoft RPC, so it is often used as an entry point for discovery and follow-on exploitation. Attackers probe it to identify RPC services, map reachable hosts, and identify systems that expose vulnerable remote procedure calls. Network Ports and Protocols Security Guide is useful background for understanding why this port is frequently included in perimeter hardening and scanning discussions. IANA is the authoritative registry context for port and protocol identifiers.

The attack value of port 135 is usually not the port itself, but what it reveals. Once a host answers on that port, an adversary can pivot to RPC services that may expose remote administration, service enumeration, or a vulnerable interface. That makes port 135 a common first touch in worming, lateral movement preparation, and broad reconnaissance against Windows environments.

In practice, defenders should treat exposed port 135 as a sign that host-level exposure is broader than a single port rule suggests. If the system is reachable from untrusted networks, the likely next step is not just more scanning, but RPC enumeration followed by exploit attempts against exposed services. CISA cyber threat advisories are a good place to check whether current exploitation campaigns are using RPC exposure patterns in the wild. NCSC UK Advice and Guidance also provides practical perimeter-hardening and remote-access guidance that maps well to this exposure pattern.

Why port 135 is attractive to worms and exploit chains

Port 135 is attractive because it is often exposed on systems that still rely on Windows RPC for legitimate administration and service discovery. That makes it useful to automated malware, mass scanners, and human operators looking for a quick way to fingerprint Windows hosts. If a worm or exploit kit can enumerate a service behind RPC, it may gain a path to remote code execution, privilege escalation, or lateral spread without needing a custom foothold on every target.

Attackers also benefit from the fact that endpoint mappers help them find the actual RPC service behind the port. That means port 135 can act as a broker for follow-on traffic to dynamic RPC endpoints, so blocking only the obvious port while leaving the broader RPC exposure unchanged may not materially reduce risk. The defensive priority is therefore to constrain who can reach the port, not just to notice that it is open.

For that reason, abnormal RPC traffic should be read as an early warning signal, especially when it comes in bursts, hits many hosts, or is followed by service enumeration attempts. Rapid scanning, repeated binds, and unusual remote calls are often more actionable than a single connection event because they indicate reconnaissance has progressed into active targeting.

How to reduce exposure without breaking legitimate RPC use

The safest approach is to narrow exposure to the smallest set of trusted hosts and management paths that actually need RPC. That usually means filtering at network boundaries, segmenting management networks, and avoiding broad Internet exposure of Windows RPC services. Where RPC is required, restrict it to known administrative sources and confirm that host firewalls and upstream controls are both enforcing the same policy.

Patching matters because attackers commonly chain port 135 exposure with known RPC flaws in exposed endpoints. If patching must wait, reduce reachable surface first, then watch for signs of probing, enumeration, or exploit attempts. In many environments, that order matters more than the sequence of internal remediation tasks because a reachable RPC surface can be targeted immediately.

Defenders should also verify whether adjacent services expand the blast radius. A host that exposes port 135 may also expose other Microsoft services or dynamic RPC traffic that are equally relevant to incident response. Limiting the port is useful, but confirming the full RPC path is what determines whether exposure is truly contained.

Risk and Threat Considerations

Port 135 becomes risky when it is reachable from untrusted networks, because it gives attackers a low-friction way to discover Windows RPC services and test for exposed weaknesses. The same feature that helps legitimate clients locate services also helps worms and intruders enumerate targets at scale, especially in flat networks or lightly filtered perimeter zones.

Failure mechanism: Exposed endpoint mapping allows reconnaissance, then service discovery, then exploitation of a vulnerable RPC service or dynamic RPC endpoint. If the surrounding network permits broad reachability, a single exposed host can become a launch point for lateral movement or worm propagation.

Impact: The likely outcomes are host compromise, rapid spread across Windows assets, and increased exposure to remote code execution attempts against services that were never meant to be Internet-facing. In incident handling, that usually means port 135 exposure should be treated as a control gap, not just a scan finding.

Practitioner Guidance

What to verify: Confirm whether port 135 is exposed only where RPC is operationally required, and validate that boundary controls block it everywhere else. If the answer is unclear, assume the exposure is broader than intended until proven otherwise.

Decision rule: If the port is reachable outside a tightly controlled management path, prioritise exposure reduction and traffic filtering before deeper tuning. If the host is already showing scanning or unusual RPC binds, treat it as a higher-priority investigation rather than a routine hardening task.

What practitioners underestimate: Blocking one port does not always remove RPC risk if dynamic endpoints or adjacent Microsoft services remain reachable. The practical question is not “is port 135 closed somewhere?”, but “can an attacker still discover and reach usable RPC functionality?”

Practitioner takeaway: Port 135 is most dangerous when it remains broadly reachable, because its discovery value can be as important to attackers as the exploit surface itself.

Related resources from NHI Mgmt Group

• How can organizations counter AI-driven cyber attacks?
• What attacks target Port 445 (SMB)?
• What attacks target port 53 for DNS?
• Is it safe to expose Port 135 (RPC) to the internet?