Description A remote service was created via RPC over SMB Attacker's Goals Process creation on a remote host. Investigative Actions Check whether the new process is benign, and that the new process is not doing suspicious activity.