RPC Connection to Endpoint Mapper (svchost.exe)
Detects inbound RPC Endpoint Mapper connections (TCP 135) to the Service Host process (svchost.exe). This connection acts as the necessary precursor to authenticating and instantiating remote COM objects for lateral movement.
Microsoft Sentinel (KQL)
