Used to verify rpc connection
rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLM
Send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
Capture credentials on a non-standard port
C:\Windows\System32\rpcping.exe, C:\Windows\SysWOW64\rpcping.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml
Casey Smith (@subtee), Vincent Yiu (@vysecurity), Antonio Cocomazzi (@splinter_code), ap (@decoder_it)