Capture Credentials with Rpcping.exe — Detection Rule

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.