RPC, or Remote Procedure Call, is a Windows communication mechanism that lets one service or computer ask another system to run a function as if it were local. It is a core part of Windows administration and inter-process communication, so it often carries legitimate management traffic that blends into normal operations.
In cyber security, RPC matters because attackers can abuse the same trusted channel for post-compromise actions such as lateral movement, remote service control, credential abuse, and privilege escalation. Defenders watch RPC by baselining normal administrative patterns and correlating remote calls with host, user, and process telemetry. That makes suspicious activity easier to spot when RPC comes from an unusual machine, appears at an odd time, or lines up with other signs of intrusion. Good visibility into RPC helps turn a routine control-plane protocol into a useful detection signal.