Credential Access via Rpcping.exe
Adversaries can abuse the legitimate Windows utility Rpcping.exe to force NTLM authentication and capture hashes by initiating an RPC connection to a target server.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 4, 03:53 UTC
- Detection
- 1 rule
- Source quality
- B2Likely
Rpcping.exe is a legitimate Windows utility designed for testing RPC connectivity. Adversaries leverage its capability to specify connection protocols and authentication mechanisms to force a target server to initiate an NTLM authentication exchange, potentially leading to NTLM hash capture if intercepted. This technique relies on the -s flag to specify the target server, combined with authentication-specific flags.
Impact
The primary risk involves the disclosure of NTLM credentials via forced authentication requests. Once NTLM hashes are captured, they may be subject to relay attacks or offline brute-force efforts to recover cleartext passwords.
Recommendation
Deploy the provided Sigma detection rule to monitor for suspicious command-line execution patterns involving Rpcping.exe. Investigate any instances where Rpcping.exe is executed with -s (server) alongside NTLM authentication flags or named pipe (ncacn_np) transport protocol strings.
Immediate actions
Deploy Sigma rule for Rpcping.exe monitoring
Threat Hunt
Identify historical usage of Rpcping.exe in environment logs
Data: Process creation events (Event ID 1)
Detection coverage 1
Detect Credential Capture via Rpcping.exe
mediumDetects the use of Rpcping.exe with command-line flags intended to force NTLM authentication or utilize named pipes for connectivity testing, indicative of potential credential access attempts.
Detection queries are available on the platform. Get full rules →