Loading story…
Google Project Zero published new .NET tooling for enumerating local Windows RPC server interfaces, generating C# clients, and interacting with Local RPC services from PowerShell or C#. The release included updates tied to the Sandbox Analysis Tools, the NtObjectManager PowerShell module, and pre-generated clients in the WindowsRpcClient project, giving researchers a practical way to inspect and call undocumented or poorly documented Windows RPC endpoints.
As a demonstration, Project Zero detailed an undocumented UAC bypass in the Windows APPINFO service’s RPC interface, specifically the RAiLaunchAdminProcess method. The technique abuses CreateProcessAsUser debug flags and reuse of a thread-associated debug object to obtain a privileged handle to an elevated process, enabling code execution with elevated rights without a UAC prompt under default configurations when paired with auto-elevated binaries such as Task Manager. The report said the issue requires direct RPC access to APPINFO, may need repeated attempts because RPC thread-pool scheduling is nondeterministic, and was intentionally described as not security-serviced by Microsoft.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Zynap Labs published an article describing a malware-analysis platform that combines a kernel-mode defensive rootkit, a hypervisor layer, and persistence-triggered execution to counter sandbox evasion used by malware such as LummaC2, GuLoader, and xLoader.
Alongside the Project Zero research, Forshaw released supporting tooling through the Sandbox Analysis Tools project, the NtObjectManager PowerShell module, and pre-generated Windows RPC clients in the WindowsRpcClient GitHub project.
On his Project Zero blog, James Forshaw published .NET tooling for extracting Local Windows RPC interfaces and generating clients, and demonstrated a previously undocumented UAC bypass in the APPINFO service's RAiLaunchAdminProcess method. He also stated he would not treat it as a security-boundary vulnerability because Microsoft does not service UAC as a security boundary.
A 2019 presentation by James Forshaw was published as a reference in the source set, indicating related public research on Windows internals preceding the later Project Zero write-up.
A PACSEC 2017 presentation on ALPC/RPC was published as a reference in the source set, providing background material relevant to later Windows Local RPC research.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
7 references tracked. Mallory keeps watching after this page renders.
zynap.com
Open sourceprojectzero.google
Open sourcegithub.com
Open sourcebugs.chromium.org
Open sourcepacsec.jp
Open sourcepowerofcommunity.net
Open sourcebugs.chromium.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple public write-ups detailed how Windows service and RPC design flaws enabled **local privilege escalation**, **sandbox escape**, and in some cases reliable code execution. Research on the Windows SSDP service linked `FC_BINDING_CONTEXT` misuse to **CVE-2025-48815**, showing that a context handle from one RPC interface could be passed into another interface expecting a different type and ultimately abused to call `CloseHandle` on an unintended handle. Separate analysis of the Windows telephony service described **CVE-2024-26230** as a use-after-free in `tapisrv` caused by improper ownership validation of RPC-managed objects, allowing a dangling pointer to be reclaimed with attacker-controlled data and steered toward `LoadLibraryW` despite **XFG** protections. Earlier Windows RPC research also covered Storage Service bugs **CVE-2019-0983** and **CVE-2019-0998**, where file-copy, directory, and ACL logic exposed through RPC could be abused to overwrite privileged files or alter their security descriptors. Other disclosures showed the same pattern across Windows subsystems. Analysis of **CVE-2022-22715** in `npfs.sys` demonstrated that malformed `LOCAL\` named pipe paths could trigger integer overflow and out-of-bounds kernel writes, enabling escape from the Adobe Reader **AppContainer** sandbox and escalation to kernel read/write. Research into **CVE-2021-1648** in `splwow64` described bypasses in printer-handle validation and an arbitrary address read, while older work on **CVE-2018-8550** examined COM `DfMarshal` abuse for elevation of privilege through privileged unmarshaling paths. Related reporting also highlighted Microsoft hard-link mitigations and a Citrix restricted-desktop breakout that relied on allowed scripting components rather than a zero-day, underscoring how weak validation, unsafe object handling, and incomplete execution controls repeatedly exposed high-impact privilege boundaries on Windows.
Aug 3, 2026
Security researchers published multiple technical demonstrations showing how Windows **User Account Control (UAC)** can still be bypassed through complex elevation paths, including a method described by James Forshaw and a later public proof of concept, **`SspiUacBypass`**, that uses **SSPI Datagram Contexts** to obtain elevated execution. The GitHub project exposes C++ research code for the technique and links it to broader work on abusing Windows elevation mechanisms, underscoring that UAC bypass tradecraft remains publicly documented and reproducible for attackers as well as defenders. A separate review of Microsoft’s upcoming Windows 11 **Administrator Protection** feature says the redesign reduces exposure to common split-token and COM auto-elevation abuse by introducing per-user **"Shadow Admin"** accounts, but does not fully eliminate legacy elevation weaknesses. The analysis says some bypass avenues and risky behaviors still persist, including issues tied to **`LocalAccountTokenFilterPolicy`**, **`RunOnce`** auto-elevation behavior, and certain **UIAccess** interactions, leaving enterprises with a transitional model where newer protections coexist with older high-integrity token paths.
Jul 24, 2026
Kaspersky disclosed **PhantomRPC**, a Windows RPC architectural weakness that can let a low-privileged local attacker escalate to **SYSTEM** or **Administrator** by standing up a fake RPC server when the legitimate server is unavailable. The flaw affects RPC client-server interactions over **ALPC** and named pipes, where a privileged client can connect to an attacker-controlled endpoint exposing the same interface and endpoint; if the attacker already has a service account with `SeImpersonatePrivilege`, such as **Network Service** or **Local Service**, they can call `RpcImpersonateClient` and assume the identity of the higher-privileged client. Researchers said the behavior stems from `rpcrt4.dll` accepting responses from spoofed servers under these failure conditions and described it as an architectural issue affecting potentially all Windows versions. The research detailed five exploitation paths, including coercing the **Group Policy** service through a fake **TermService** endpoint, waiting for **Microsoft Edge** or **WdiSystemHost** to contact TermService, abusing `ipconfig.exe` when the **DHCP Client** service is disabled, and abusing `w32tm.exe` through a nonexistent **W32Time** pipe. Proof-of-concept testing was reported on **Windows Server 2022** and **Windows Server 2025**. Microsoft was notified in 2025 but classified the issue as moderate severity, assigned no **CVE**, and did not plan an immediate patch. Kaspersky recommended **ETW-based** monitoring for `RPC_S_SERVER_UNAVAILABLE` failures, reducing unnecessary `SeImpersonatePrivilege`, enabling disabled services where practical, and using released GitHub assessment tools to identify exposed RPC client-server mismatches.
Jun 29, 2026