Windows event log RPC abuse shows low-privilege write risk

At a glance

What this is: SafeBreach shows that the MS-EVEN RPC service on Windows 11 and Windows Server 2025 allowed low-privileged remote file writes, bypassing default share limitations and enabling domain propagation paths.

Why it matters: IAM and NHI teams need to treat low-privilege service paths as potential write-capable access, because remote permissions can translate into lateral movement even without high-value credentials.

Context

Windows event log RPC abuse is a governance problem as much as a vulnerability problem. When a remotely reachable service exposes file-write behaviour to low-privileged callers, access boundaries no longer line up with the assumptions behind least privilege and share-based controls. That creates an identity and execution risk even when the user account itself looks harmless.

In this case, the issue sits in Microsoft Windows MS-EVEN, the RPC surface behind remote event log functions. SafeBreach describes how that surface enabled arbitrary remote file writes on Windows 11 and Windows Server 2025, which matters because domain-wide reach turns an apparently narrow permission into a propagation mechanism.

Key questions

Q: What breaks when low-privilege Windows accounts can write files through RPC services?

A: The security boundary breaks because the account can be used for more than its intended login scope. A remote file write path can turn ordinary credentials into a propagation mechanism, especially if the service can reach startup folders or DLL load locations. That changes low privilege from an access label into a code-execution path.

Q: Why does low-privilege remote file writing create lateral movement risk in Windows domains?

A: Because domain membership often makes writable folders available on multiple machines, so one low-privilege credential can place files in locations that trigger execution or staging elsewhere. The risk is not administrative takeover. It is the ability to turn ordinary group access into a propagation path across shared Windows paths.

Q: What are the signs that an RPC-based file path is being abused?

A: Watch for remote calls to event log or backup functions that unexpectedly touch file paths, produce create and existence errors, or interact with user-writable folders on a host. Those signals show that a service is doing more than reading logs and may be exposing unintended write behaviour.

Q: Should teams treat remote write primitives as a separate risk from credential theft?

A: Yes. Credential theft matters, but a remote write primitive can be enough to stage code, persistence, or propagation even when the caller never gains high privilege. Teams should assess whether a service can create or copy files remotely, because that capability changes the blast radius of a low-privilege account.

Technical breakdown

Why MS-EVEN remote calls can become a write primitive

MS-EVEN is a Windows RPC interface used for remote event log operations. RPC services expose callable functions through endpoints, but each function still has its own binding and authorization checks. SafeBreach’s research shows that when a service accepts a low-privilege bind and then performs file handling on the caller’s behalf, the boundary between information retrieval and file modification can collapse. In practice, a function that looks like a backup or read-oriented operation may still invoke file creation, file existence checks, or write behaviour under service context. That is why RPC exposure alone is not the issue. The issue is which primitives the interface actually grants once binding succeeds.

Practical implication: inventory remotely callable RPC interfaces and validate what file-system primitives they expose, not just whether they are reachable.

How low-privilege access turned into arbitrary remote file writes

The report describes a path from remote event log access to a hidden CreateFile primitive and then to a write primitive through backup-style behaviour. The service first revealed file and directory existence through error states, then allowed a caller to make the remote machine open a file from an external share, and finally write content to an accessible location on the target. That sequence matters because it bypasses the normal expectation that low-privileged users cannot write into protected areas on remote systems. The result is not simple file access. It is a remote-write capability created by service logic and permission mismatch.

Practical implication: test backup and log-export functions for unintended write paths, especially where service identity differs from caller identity.

Why domain membership magnifies the impact of a low-privilege write

A low-privilege account on one Windows host is not always low impact across a domain. SafeBreach shows that common domain group access can make writable paths available on many remote systems, including locations such as ProgramData and Startup-related folders. That turns the write primitive into a propagation path because one credential can touch multiple machines where the Users group has write access. The important technical point is that the attack does not need admin rights to matter. It needs only a place where a default service path and a default directory permission intersect in a dangerous way.

Practical implication: review domain-wide writable paths and treat shared group permissions as potential lateral movement surfaces.

Threat narrative

Attacker objective: The objective is to turn low-privilege Windows access into remote file planting and domain propagation opportunities that support execution or reconnaissance.

1. Entry occurred through the MS-EVEN RPC service, which was enabled by default and reachable remotely on Windows 11 and Windows Server 2025. Low-privileged credentials were enough to bind to the interface and begin interacting with event log functions.
2. Credential access was not the main objective here, but the attacker-controlled workflow used service behaviour to test file existence, open remote files from an external share, and pivot into a writable operation that bypassed ordinary C$ share limits.
3. Escalation came from converting a nominal event-log function into a hidden remote write primitive, then using writable locations such as Startup or other user-accessible paths to stage execution or propagation.
4. Impact was the ability to plant files remotely across domain-joined systems and create follow-on execution or reconnaissance paths without needing elevated credentials.

Breaches seen in the wild

• ASP.NET machine key attacks 2025: Developers copied ASP.NET machine keys from public sources; attackers used one to run Godzilla via ViewState. Microsoft found 3,000+ such keys.
• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Low privilege is not a meaningful control boundary when a service exposes write primitives: This research shows that identity assurance based only on account rank fails when the service itself performs the write on behalf of the caller. A user can remain low-privileged and still gain a high-impact primitive if the RPC surface accepts the bind and translates a backup-style call into file creation or file copying. Practitioners should treat exposed service behaviour as part of the access model, not as a separate implementation detail.

Default-enabled Windows services can become identity shortcuts across the domain: MS-EVEN was enabled by default on Windows 11 and Windows Server 2025, which means the attack surface exists before any local hardening conversation begins. In a domain, that default service behaviour intersects with broad group-based write permissions and can extend one caller’s reach far beyond the host they authenticated to. The implication is that service reachability and domain membership must be reviewed together, not separately.

Remote write capability changes the meaning of least privilege: Least privilege usually assumes the privilege set is stable and obvious at provisioning time. That assumption weakens when a remote protocol turns information-gathering actions into file-system side effects, because the effective privilege is created at runtime by the service path itself. The practitioner conclusion is that authorization reviews must include protocol semantics, not just account entitlement.

Event-log RPC abuse creates identity blast radius through writable paths: The important risk is not only remote code execution, but the ability to convert benign-looking directories such as Startup or shared program locations into propagation points. That means an apparently narrow credential can still create cross-host exposure when service design and directory permissions meet. Teams should map which remote services can write, where they can write, and what execution outcomes those writes can trigger.

Arbitrary remote writes deserve the same governance attention as credential compromise: Many security programmes prioritise stolen credentials, but this case shows that a write primitive can be just as operationally dangerous when it lands on the right path. A hidden CreateFile plus a usable backup-write path creates persistence and staging opportunities without any password theft at all. The practitioner takeaway is to govern remote write behaviour as an access-risk class in its own right.

What this signals

Remote write primitives belong in identity governance reviews: Security teams usually scope identity risk around who can log in or authenticate. This case shows that some services effectively grant a second layer of privilege at runtime, where the real question is not who the user is but what the protocol lets them make the system do. That is a governance gap, not just a vulnerability bug.

Event-log exposure is an identity blast-radius issue: When a default Windows service can be reached by low-privileged users and can influence file placement, the resulting blast radius extends far beyond the original session. The practical consequence is that access reviews, service hardening, and domain path governance need to be evaluated together instead of in separate silos.

For practitioners

• Audit remotely reachable RPC services Identify Windows RPC interfaces that accept remote binds from low-privileged users and document any file-system side effects they produce, including create, backup, or existence-check behaviour.
• Restrict writable domain paths Review domain-wide directories that ordinary users can write to, especially Startup, ProgramData, and per-user application folders, then remove unnecessary write access where propagation is possible.
• Test service semantics, not only permissions Validate whether a service that appears read-only can still write files indirectly through helper functions, backup workflows, or error-driven primitives that expose the target file system.
• Map low-privilege remote execution paths Trace how a remote write primitive could lead to logon-time execution, DLL loading, or scheduled propagation on domain-joined machines before assuming the credential is operationally harmless.

Key takeaways

• Low-privilege Windows access can still produce high-impact outcomes when a remotely reachable service exposes write behaviour.
• The research shows that a default-enabled RPC path can bypass share limitations and create propagation opportunities across domain systems.
• Practitioners should review remote services for unintended file operations and treat writable paths as lateral movement surfaces.

Key terms

• Remote Write Primitive: A remote write primitive is a capability that lets a user place or modify files on another system through a network service. In identity terms, it matters because the service has effectively expanded the caller's authority beyond normal file permissions and can convert low privilege into execution risk.
• Protocol Semantics: Protocol semantics are the actual actions a network service performs when a request is accepted, including side effects such as file creation, backup handling, or directory checks. In security analysis, semantics matter more than the label on the service because they define the real access boundary.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Writable Path Exposure: Writable path exposure occurs when ordinary users or low-privilege identities can place files in locations that have security or execution consequences. For Windows environments, that can turn a shared folder, startup location, or application directory into a staging point.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.