A computing device comprising: one or more processors; and a security agent configured to be operated by the one or more processors to perform operations including: receiving one or more event notifications respectively associated with one or more kernel-mode events; determining, based on the one or more event notifications, that the one or more kernel-mode events are associated with user-mode processing, by a remote-procedure-call-utilizing, RPC-utilising, process, of a request message; retrieving the request message based on information included in one or more remote procedure call data structures and based on the one or more event notifications, wherein the retrieving includes: determining a thread environment block, TEB, of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and tracing from the TEB to the request message through an RPC-specific field of an operating system, OS, data structure; and identifying an originator of the request message based on metadata of the request message. one or more processors; and a security agent configured to be operated by the one or more processors to perform operations including: receiving one or more event notifications respectively associated with one or more kernel-mode events; determining, based on the one or more event notifications, that the one or more kernel-mode events are associated with user-mode processing, by a remote-procedure-call-utilizing, RPC-utilising, process, of a request message; retrieving the request message based on information included in one or more remote procedure call data structures and based on the one or more event notifications, wherein the retrieving includes: determining a thread environment block, TEB, of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and tracing from the TEB to the request message through an RPC-specific field of an operating system, OS, data structure; and identifying an originator of the request message based on metadata of the request message. receiving one or more event notifications respectively associated with one or more kernel-mode events; determining, based on the one or more event notifications, that the one or more kernel-mode events are associated with user-mode processing, by a remote-procedure-call-utilizing, RPC-utilising, process, of a request message; retrieving the request message based on information included in one or more remote procedure call data structures and based on the one or more event notifications, wherein the retrieving includes: determining a thread environment block, TEB, of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and tracing from the TEB to the request message through an RPC-specific field of an operating system, OS, data structure; determining a thread environment block, TEB, of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and tracing from the TEB to the request message through an RPC-specific field of an operating system, OS, data structure; and identifying an originator of the request message based on metadata of the request message.