Notifications
Clear all
Topic starter
02/08/2026 12:32 pm
TL;DR: An RPC endpoint mapper weakness let a low-privilege process race built-in Windows services, masquerade as a trusted RPC server, and force protected processes to authenticate to an attacker-controlled endpoint, exposing the machine account NTLM hash, according to SafeBreach. The finding shows that client-side trust assumptions in inter-process identity can be abused long before conventional access controls have a chance to respond.
NHIMG editorial — based on content published by SafeBreach: You Snooze You Lose: RPC-Racer Winning RPC Endpoints Against Services
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when a Windows RPC client trusts the first endpoint it receives?
A: The client can connect to a rogue server that only looks legitimate because it registered first.
Q: Why do delayed-start services increase RPC endpoint hijack risk?
A: Delayed-start services create a time window in which an attacker can register a matching interface before the real service appears.
Q: How do security teams know if RPC interface registration is being abused?
A: Look for unexpected processes calling RpcEpRegister for interfaces that belong to built-in Windows services, especially during boot.
Practitioner guidance
- Map RPC interfaces that register late in boot Inventory services that depend on delayed start and note which interfaces are claimed only after core system startup.
- Verify server identity before accepting RPC endpoints Review client paths that trust a UUID-to-endpoint resolution without an explicit server-authentication check.
- Monitor for unexpected RpcEpRegister activity Detect non-standard processes calling RpcEpRegister for known built-in interfaces and correlate that activity with boot timing, service creation, and subsequent client connections.
What's in the full report
SafeBreach's full research covers the operational detail this post intentionally leaves for the source:
- The step-by-step EPM poisoning technique and how the race against built-in services was won in practice.
- The exact RPC interfaces and service behaviours that were observed to be vulnerable during boot.
- The detection methods using ETW and RpcEpRegister monitoring that help distinguish legitimate from rogue registrations.
- The patch response and the residual exposure in other RPC clients and interfaces that may still be reachable.
👉 Read SafeBreach's analysis of RPC endpoint mapper poisoning in Windows →
RPC endpoint poisoning in Windows: what IAM and security teams need to know?
Explore further
02/08/2026 1:29 pm
Endpoint registration order is not an identity control. This research shows that the endpoint mapper accepted the first matching registration, even when the responder was not the legitimate built-in service. That is a structural failure in protocol trust, not just a hardening gap. For identity programmes, the lesson is that naming and registration are not proof of authority.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and sometimes within 9 minutes, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- DeepSeek accidentally embedded over 11,000 secrets in its training data and left a database exposed online, revealing more than one million sensitive records including chat histories, backend credentials, and API keys.
A question worth separating out:
Q: Who is accountable when a protected process authenticates to a fake RPC server?
A: Accountability sits with the operating-system trust boundary and the teams that own service identity, client verification, and hardening of privileged IPC paths. If a protected process can authenticate to an unverified endpoint, then the governance failure is in the control design, not only in the attacker technique.
👉 Read our full editorial: Windows RPC endpoint poisoning exposes machine-account authentication
