Capture Credentials with Rpcping.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•2•0•17

This rule detects the use of 'Rpcping.exe' to force NTLM authentication by sending an RPC test connection to a target server. This technique can be used by attackers to capture NTLM hashes, which can then be cracked offline to obtain user credentials.