I haven't been able to produce this event. Have you? Please email any comments you may have! Don't forget to sanitize any private information.
Subject:
SID:
Name:
Account Domain:
LogonId:
Process Information:
PID:
Name:
Network Information:
Remote IP Address:
Remote Port:
RPC Attributes:
Interface UUID:
OpNum:
Protocol Sequence:
Authentication Service:
Authentication Level:
A Remote Procedure Call (RPC) was attempted.
Subject:
SID: %1
Name: %2
Account Domain: %3
LogonId: %4
Process Information:
PID: %5
Name: %6
Network Information:
Remote IP Address: %7
Remote Port: %8
RPC Attributes:
Interface UUID: %9
OpNum: %13
Protocol Sequence: %10
Authentication Service: %11
Authentication Level: %12
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection