Capture Credentials with Rpcping.exe

calendar Mar 15, 2024 · attack.credential_access attack.t1003  ·
Share on: linkedin copy

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

Sigma rule (View on GitHub)

 1title: Capture Credentials with Rpcping.exe
 2id: 93671f99-04eb-4ab4-a161-70d446a84003
 3status: test
 4description: Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
 5references:
 6    - https://lolbas-project.github.io/lolbas/Binaries/Rpcping/
 7    - https://twitter.com/vysecurity/status/974806438316072960
 8    - https://twitter.com/vysecurity/status/873181705024266241
 9    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875578(v=ws.11)
10author: Julia Fomina, oscd.community
11date: 2020/10/09
12modified: 2024/03/13
13tags:
14    - attack.credential_access
15    - attack.t1003
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    use_rpcping:
21        Image|endswith: '\rpcping.exe'
22    remote_server:
23        CommandLine|contains|windash: '-s'
24    ntlm_auth:
25        - CommandLine|contains|all|windash:
26              - '-u'
27              - 'NTLM'
28        - CommandLine|contains|all|windash:
29              - '-t'
30              - 'ncacn_np'
31    condition: use_rpcping and remote_server and ntlm_auth
32falsepositives:
33    - Unlikely
34level: medium

References

  • Rpcping | LOLBAS

    Trigger an authenticated RPC call to the target server (/s) that could be relayed to a privileged resource (Sign not Set). rpcping /s 10.0.0.35 /e 9997 /a connect /u NTLM Use caseRelay a NTLM authe...


    Read More

  • Something went wrong, but don’t fret — let’s give it another shot.


    Read More

  • Something went wrong, but don’t fret — let’s give it another shot.


    Read More

  • Rpcping

    /t Specifies the protocol sequence to use. Can be one of the standard RPC protocol sequences, for example: ncacn_ip_tcp, ncacn_np, or ncacn_http. If not specified, default is ncacn_ip_tcp. /s Speci...


    Read More

Related rules

to-top