PhantomRPC — Unpatched Windows RPC Local Privilege Escalation to SYSTEM via Fake RPC Server Impersonation (Kaspersky) — Threadlinqs Intelligence
As of 2026-05-30, PhantomRPC — Unpatched Windows RPC Local Privilege Escalation to SYSTEM via Fake RPC Server Impersonation (Kaspersky) is a high-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0420 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: VULNERABILITY
Attribution: N/A · UNKNOWN
PhantomRPC is a novel local privilege escalation technique disclosed by Kaspersky Security Services researcher Haidar Kabibo on 2026-04-24. An attacker with SeImpersonatePrivilege stands up a
PhantomRPC is an architectural weakness in Windows Remote Procedure Call (RPC) that permits local privilege escalation from any account holding SeImpersonatePrivilege (default for Local Service, Network Service, and IIS/MSSQL service accounts) up to NT AUTHORITY\SYSTEM. The technique was published on 2026-04-24 by Haidar Kabibo of Kaspersky Security Services (GReAT / SecureList).
Root cause: Windows RPC does not verify the legitimacy or identity of RPC servers before a client negotiates an impersonation-level (RPC_C_IMP_LEVEL_IMPERSONATE or RPC_C_IMP_LEVEL_DELEGATE) connection. When a well-known Windows service is not running, the RPC runtime returns RPC_S_SERVER_UNAVAILABLE (0x800706BA) to clients. An attacker with SeImpersonatePrivilege can register a malicious endpoint bound to the same interface UUID and protocol sequence (ncalrpc / ncacn_np named pipes such as \PIPE\W32TIME and \PIPE\W32TIME_ALT) before the legitimate service starts, or in scenarios where the service never runs. When a privileged client process makes an RPC call, it connects to the attacker's endpoint. The malicious server then invokes RpcImpersonateClient to obtain a primary impersonation token for the calling identity, which can be elevated to SYSTEM via standard token-theft primitives (CreateProcessWithTokenW / DuplicateTokenEx → CreateProcessAsUserW).
Kaspersky documented five reliable coercion paths on fully-patched Windows Server 2022 and Windows Server 2025: (1) Group Policy Client (gpsvc) — triggered by 'gpupdate /force', yielding a SYSTEM token; (2) Terminal Services (TermService) — triggered by launching msedge.exe, yielding the current user's token, useful for session hijacking; (3) Diagnostic System Host (WdiSystemHost/WDI) — autonomous trigger every 5–15 minutes, SYSTEM token; (4) DHCP Client service — triggered by 'ipconfig /renew' or 'ipconfig /release', administrator token; (5) Windows Time (W32Time) — triggered by 'w32tm.exe /resync', exposes named pipes \PIPE\W32TIME and \PIPE\W32TIME_ALT.
Disclosure history: the vulnerability was reported to MSRC on 2025-09-19 as Case 101749. On 2025-10-10 Microsoft declined to patch, classifying the issue as moderate severity because SeImpersonatePrivilege is required, and refused to assign a CVE. Kaspersky honored a multi-month embargo before publishing on 2026-04-24. Because Microsoft has no plans to fix the architectural flaw, all present and future Windows versions are assumed vulnerable.
Detection: Kaspersky released an ETW-based framework that captures events from the Microsoft-Windows-RPC provider (GUID {6ad52b32-d609-4be9-ae07-ce8dae937e39}). Event ID 5 (RPC start) and Event ID 1 (RPC stop) are correlated by ActivityID; a stop event carrying status 0x800706BA (RPC_S_SERVER_UNAVAILABLE) against a sensitive interface UUID from a privileged caller is the primary signal that a client has just failed to reach a legitimate service — the exact window in which a PhantomRPC server would take over. The klsecservices/PhantomRPC GitHub repository ships a Python enricher (enricher.py) that joins RPC interface names from interfaces.json and filters on impersonation level, endpoint, and client privilege.
Impact: Although SYSTEM is reachable today from Local Service / Network Service via other public primitives (the Potato family, SCMUACBypass, etc.), PhantomRPC is notable because (a) no patch is forthcoming, (b) it works against the latest Server 2022/2025 builds, (c) it blends into normal RPC traffic and does not require exploit shellcode, and (d) the gpsvc / WDI paths allow passive SYSTEM acquisition with no user interaction. Blue teams should treat this as an evergreen post-exploitation primitive and deploy ETW detection coverage immediately.
Weaknesses (CWE)
CWE-287, CWE-290, CWE-345, CWE-346, CWE-284, CWE-269
Target sectors: government, financial, healthcare, technology, defense, energy, manufacturing, education, telecommunications, critical infrastructure
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1068, T1134, T1134.001, T1134.002, T1134.003, T1548, T1134, T1134.001, T1036.005, T1574