Used to verify rpc connection

Paths:

C:\Windows\System32\rpcping.exe
C:\Windows\SysWOW64\rpcping.exe

Detection:

Credentials

Send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLM