RPCMon is a GUI tool for scanning RPC communication through Event Tracing for Windows (ETW). It was built like Procmon

GoExec is a new tool for Windows remote execution, offering significant OPSEC improvements and leveraging RPC, Task Scheduler, DCOM, and WMI for stealthy operations.

COMmander is a lightweight, practical tool that monitors deep-seated RPC and COM activities in Windows, designed to detect subtle, invisible threats that bypass traditional security.

Evilent, a new PoC tool, exploits the Windows Event Log service to coerce connections to an attacker-controlled SMB share, potentially leaking NetNTLMvLMv2 credentials from antivirus scans.

A new "EPM Poisoning" attack technique exploits a Windows RPC flaw (CVE-2025-49760) to hijack services, enabling unprivileged users to steal machine credentials and compromise Active Directory.

A new "EPM poisoning" attack bypasses Windows security by hijacking the RPC protocol, allowing an unprivileged user to escalate privileges and steal NTLM hashes.

A critical flaw in Apache bRPC's Redis parser (CVE-2025-54472) allows unauthenticated remote attackers to crash services via a memory allocation bug. Update to 1.14.1 immediately!

RPC Investigator (RPCI) is a .NET/C# Windows Forms UI application that provides an advanced discovery and analysis interface to Windows RPC endpoints

COMmander is a new, lightweight C# tool that leverages the Windows RPC ETW provider to enrich defensive telemetry, enabling granular detection of RPC/COM events.

FusterCluck PoC exploits the Windows Cluster API over RPC to migrate cluster groups and achieve lateral movement across all nodes of a failover cluster.