593

Port 593/tcp is registered with IANA as http-rpc-epmap with the description "HTTP RPC Ep Map," assignee and contact Edward Reus (an individual, not "Microsoft"), and a blank reference field (dual-registered on TCP and UDP). It is the Microsoft RPC endpoint mapper reachable over HTTP — the RPC-over-HTTP counterpart to the DCE endpoint mapper on port 135 (epmap) — letting RPC and DCOM clients reach services through an RPC-over-HTTP proxy. The classic case is Outlook connecting to Exchange via Outlook Anywhere (the RPC-over-HTTP Proxy, introduced in the Exchange 2003 era): MSRPC is tunneled over HTTP, with the endpoint mapper available on TCP 593 (and the RPC proxy fronted by IIS on 80/443), and enumeration tools such as Impacket's rpcdump can list dynamically registered RPC services via 593. It is defined in Microsoft's open specification [MS-RPCH]. The IANA reference field is blank. Security-wise this is a significant Windows attack surface: an open 593 indicates Windows RPC-over-HTTP, frequently Exchange, and RPC-over-HTTP together with the broader MSRPC/135 surface has featured in Exchange attack chains, so if internet-exposed it can enable remote code execution, sensitive-data exposure, and denial of service. For an analyst, an open 593 is a Windows server speaking RPC-over-HTTP — very often an Exchange or Outlook Anywhere endpoint — and it should be firewalled to internal addresses or fronted by authenticated IIS rather than exposed publicly.

IANA assignment

http-rpc-epmap — "HTTP RPC Ep Map"; reference (blank — no RFC cited; [MS-RPCH] is the Microsoft open spec); assignee Edward Reus; dual-registered 593/tcp + 593/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

appears on Windows/Exchange estates; nmap-services de-facto moderate [Well-established] — nmap-services file

Related ports

135 (epmap), 80/443 (RPC proxy front-end), Exchange ports

Primary use

Microsoft RPC-over-HTTP endpoint mapper — RPC/DCOM reachable via an RPC-over-HTTP proxy

Other/unofficial uses

Exchange Outlook Anywhere / RPC proxy endpoint [Well-established]

Security implications

significant Windows attack surface (RPC-over-HTTP, often Exchange); part of the MSRPC/135 surface that has featured in Exchange attack chains; never internet-expose [Well-established/Threat-reported]

Typically seen on

Windows servers / Exchange (Outlook Anywhere, RPC proxy)

Analyst note

An open 593 is a Windows server speaking RPC-over-HTTP — very often an Exchange/Outlook Anywhere endpoint; it should not be on the public internet.