Port 135 (Microsoft RPC endpoint mapper)
Windows RPC endpoint mapper, used by DCOM, WMI and many management tools.
- Transport
- TCP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- Used for remote execution and lateral movement (WMI, DCOM, scheduled tasks).
- Historically the vector for the Blaster worm (2003).
When it shows up in your logs
Workstation-to-workstation RPC is unusual in most networks and can indicate lateral movement.