# PhantomRPC — Unpatched Windows RPC Local Privilege Escalation to SYSTEM via Fake RPC Server Impersonation (Kaspersky)

> PhantomRPC is a novel local privilege escalation technique disclosed by Kaspersky Security Services researcher Haidar Kabibo on 2026-04-24. An attacker with SeImpersonatePrivilege stands up a malicious RPC server impersonating legitimate but unavailable Windows services (Terminal Services, DHCP Client, Windows Time, gpsvc, WdiSystemHost), waits for privileged clients to connect, then calls RpcImpersonateClient to assume SYSTEM context. Microsoft (MSRC Case 101749) declined to patch and refused to assign a CVE, classifying the issue as moderate, so Windows Server 2022/2025 and effectively all current Windows versions remain exposed. Public PoC and an ETW-based detection framework are available on GitHub (klsecservices/PhantomRPC).

- **Published:** 2026-04-24T12:00:00Z
- **Last reviewed:** 2026-04-24T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0420
- **ID:** TL-2026-0420
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PhantomRPC is an architectural weakness in Windows Remote Procedure Call (RPC) that permits local privilege escalation from any account holding SeImpersonatePrivilege (default for Local Service, Network Service, and IIS/MSSQL service accounts) up to NT AUTHORITY\SYSTEM. The technique was published on 2026-04-24 by Haidar Kabibo of Kaspersky Security Services (GReAT / SecureList).

Root cause: Windows RPC does not verify the legitimacy or identity of RPC servers before a client negotiates an impersonation-level (RPC_C_IMP_LEVEL_IMPERSONATE or RPC_C_IMP_LEVEL_DELEGATE) connection. When a well-known Windows service is not running, the RPC runtime returns RPC_S_SERVER_UNAVAILABLE (0x800706BA) to clients. An attacker with SeImpersonatePrivilege can register a malicious endpoint bound to the same interface UUID and protocol sequence (ncalrpc / ncacn_np named pipes such as \PIPE\W32TIME and \PIPE\W32TIME_ALT) before the legitimate service starts, or in scenarios where the service never runs. When a privileged client process makes an RPC call, it connects to the attacker's endpoint. The malicious server then invokes RpcImpersonateClient to obtain a primary impersonation token for the calling identity, which can be elevated to SYSTEM via standard token-theft primitives (CreateProcessWithTokenW / DuplicateTokenEx → CreateProcessAsUserW).

Kaspersky documented five reliable coercion paths on fully-patched Windows Server 2022 and Windows Server 2025: (1) Group Policy Client (gpsvc) — triggered by 'gpupdate /force', yielding a SYSTEM token; (2) Terminal Services (TermService) — triggered by launching msedge.exe, yielding the current user's token, useful for session hijacking; (3) Diagnostic System Host (WdiSystemHost/WDI) — autonomous trigger every 5–15 minutes, SYSTEM token; (4) DHCP Client service — triggered by 'ipconfig /renew' or 'ipconfig /release', administrator token; (5) Windows Time (W32Time) — triggered by 'w32tm.exe /resync', exposes named pipes \PIPE\W32TIME and \PIPE\W32TIME_ALT.

Disclosure history: the vulnerability was reported to MSRC on 2025-09-19 as Case 101749. On 2025-10-10 Microsoft declined to patch, classifying the issue as moderate severity because SeImpersonatePrivilege is required, and refused to assign a CVE. Kaspersky honored a multi-month embargo before publishing on 2026-04-24. Because Microsoft has no plans to fix the architectural flaw, all present and future Windows versions are assumed vulnerable.

Detection: Kaspersky released an ETW-based framework that captures events from the Microsoft-Windows-RPC provider (GUID {6ad52b32-d609-4be9-ae07-ce8dae937e39}). Event ID 5 (RPC start) and Event ID 1 (RPC stop) are correlated by ActivityID; a stop event carrying status 0x800706BA (RPC_S_SERVER_UNAVAILABLE) against a sensitive interface UUID from a privileged caller is the primary signal that a client has just failed to reach a legitimate service — the exact window in which a PhantomRPC server would take over. The klsecservices/PhantomRPC GitHub repository ships a Python enricher (enricher.py) that joins RPC interface names from interfaces.json and filters on impersonation level, endpoint, and client privilege.

Impact: Although SYSTEM is reachable today from Local Service / Network Service via other public primitives (the Potato family, SCMUACBypass, etc.), PhantomRPC is notable because (a) no patch is forthcoming, (b) it works against the latest Server 2022/2025 builds, (c) it blends into normal RPC traffic and does not require exploit shellcode, and (d) the gpsvc / WDI paths allow passive SYSTEM acquisition with no user interaction. Blue teams should treat this as an evergreen post-exploitation primitive and deploy ETW detection coverage immediately.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1134.002 Access Token Manipulation: Create Process with Token
- T1134.003 Access Token Manipulation: Make and Impersonate Token
- T1548 Abuse Elevation Control Mechanism
- T1036.005 Match Legitimate Resource Name or Location
- T1574 Hijack Execution Flow
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1569.002 System Services: Service Execution
- T1559 Inter-Process Communication
- T1649 Steal or Forge Authentication Certificates
- T1007 System Service Discovery
- T1057 Process Discovery
- T1069 Permission Groups Discovery
- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits

## Sources

- [PhantomRPC: A new privilege escalation technique in Windows RPC (Securelist)](https://securelist.com/phantomrpc-rpc-vulnerability/119428/)
- [klsecservices/PhantomRPC — PoC, ETW tooling, interfaces database](https://github.com/klsecservices/PhantomRPC)
- [Microsoft Learn — SeImpersonatePrivilege and SeCreateGlobalPrivilege](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/seimpersonateprivilege-secreateglobalprivilege)
- [Microsoft Learn — RPC Impersonation and Identification](https://learn.microsoft.com/en-us/windows/win32/rpc/impersonation)
- [Microsoft Learn — RPC Interface Definition Language (MIDL)](https://learn.microsoft.com/en-us/windows/win32/rpc/the-interface-definition-language-file)
- [MITRE ATT&CK — T1134.001 Access Token Manipulation: Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001/)
- [MITRE ATT&CK — T1068 Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068/)
- [Microsoft-Windows-RPC ETW Provider Reference](https://learn.microsoft.com/en-us/windows/win32/etw/about-event-tracing)
- [Haidar Kabibo (@haider_kabibo) — PhantomRPC disclosure author](https://twitter.com/haider_kabibo)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0420