{
  "port": 593,
  "protocol": "tcp",
  "service": "HTTP RPC endpoint mapper (RPC over HTTP)",
  "oneLiner": "Windows RPC tunnelled over HTTP — the endpoint mapper for RPC/HTTP, historically Outlook Anywhere.",
  "whatItIs": "IANA registers TCP 593 as \"http-rpc-epmap\": the HTTP RPC endpoint mapper. Microsoft's RPC over HTTP protocol ([MS-RPCH]) tunnels DCE/RPC traffic through an RPC-over-HTTP proxy so it can traverse firewalls, and 593 is the endpoint-mapper counterpart to the plain DCE endpoint mapper on TCP 135. Its best-known consumer was Outlook Anywhere against Exchange; the proxy itself normally publishes over 443, so 593 turning up on a scan is a Windows server exposing the RPC/HTTP plumbing directly.",
  "exposure": {
    "verdict": "never",
    "note": "This is an RPC control plane. Every reason TCP 135 is blocked at the perimeter applies here — clients should reach RPC/HTTP through the HTTPS proxy on 443, never this port."
  },
  "checkCommand": "nc -vz -w 3 TARGET 593",
  "links": [
    {
      "title": "[MS-RPCH]: Remote Procedure Call over HTTP Protocol",
      "url": "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpch/c0f4c9c5-1a61-4d10-b8e2-005378d1d212",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 593",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=593",
      "kind": "iana"
    }
  ]
}