A computing device comprising: one or more processors; and a security agent configured to be operated by the one or more processors to perform operations including: receiving one or more event notifications respectively associated with one or more kernel-mode events; determining , based on the one or more event notifications, that the one or more kernel-mode events are associated with user-mode processing, by a remote-procedure-call-utilizing, RPC-utilising, process, of a request message; retrieving the request message based on information included in one or more remote procedure call (RPC) data structures and based on the one or more event notifications, wherein the retrieving includes: determining a thread environment block, TEB, of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and tracing from the TEB to the request message through an RPC-specific field of an operating system, OS, data structure; and identifying an originator of the request message based on metadata of the request message. one or more processors; and a security agent configured to be operated by the one or more processors to perform operations including: receiving one or more event notifications respectively associated with one or more kernel-mode events; determining , based on the one or more event notifications, that the one or more kernel-mode events are associated with user-mode processing, by a remote-procedure-call-utilizing, RPC-utilising, process, of a request message; retrieving the request message based on information included in one or more remote procedure call (RPC) data structures and based on the one or more event notifications, wherein the retrieving includes: determining a thread environment block, TEB, of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and tracing from the TEB to the request message through an RPC-specific field of an operating system, OS, data structure; and identifying an originator of the request message based on metadata of the request message. receiving one or more event notifications respectively associated with one or more kernel-mode events; determining , based on the one or more event notifications, that the one or more kernel-mode events are associated with user-mode processing, by a remote-procedure-call-utilizing, RPC-utilising, process, of a request message; retrieving the request message based on information included in one or more remote procedure call (RPC) data structures and based on the one or more event notifications, wherein the retrieving includes: determining a thread environment block, TEB, of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and tracing from the TEB to the request message through an RPC-specific field of an operating system, OS, data structure; determining a thread environment block, TEB, of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and tracing from the TEB to the request message through an RPC-specific field of an operating system, OS, data structure; and identifying an originator of the request message based on metadata of the request message. <EOS>