Explanation
Although most DCE/RPC exploits occur in DCE/RPC client requests targeted for DCE/RPC servers, which
could be practically any host on your network that is running Windows or Samba, exploits can also occur in
server responses. The DCE/RPC preprocessor detects DCE/RPC requests and responses encapsulated in TCP,
UDP, and SMB transports, including TCP-transported DCE/RPC using version 1 RPC over HTTP. The
preprocessor analyzes DCE/RPC data streams and detects anomalous behavior and evasion techniques in
DCE/RPC traffic. It also analyzes SMB data streams and detects anomalous SMB behavior and evasion
techniques.