Signature Detail

MS-RPC: Epdump Scan Detected (2)

This anomaly detects a client enumerating MSRPC endpoints on a windows server. This can indicate a probing scan prior to a more sophisticated attack.

Extended Description

A remote attacker could enumerate the MSRPC services on a Windows Server by using EPDump to systematically query the End Point Mapper. With this information, an attacker could plan attacks to compromise the server.