Notifications
Clear all
Topic starter
02/08/2026 12:32 pm
TL;DR: Four Windows denial-of-service vulnerabilities in RPC and LDAP client behavior, plus a new Win-DDoS technique that could abuse public domain controllers to build a malicious botnet and crash Windows systems remotely, were found by SafeBreach Labs. The result is a sharper reminder that availability failures in core identity infrastructure can become both an operational and governance problem.
NHIMG editorial — based on content published by SafeBreach: Win-DoS Epidemic, a crash course in abusing RPC for Win-DoS and Win-DDoS
By the numbers:
- Gcore’s Q3-Q4 2024 Radar report revealed a 56% year-over-year increase in DDoS attacks compared with the same timeframe in 2023.
- Check Point’s Perimeter 81 said DDoS attacks are costing organizations approximately $6,000 per minute in downtime.
Questions worth separating out
Q: What breaks when domain controllers are exposed to RPC and LDAP abuse?
A: When domain controllers are exposed to abusive RPC or LDAP patterns, the failure is usually availability first.
Q: Why do directory services create outsized denial-of-service risk?
A: Directory services sit at the centre of authentication, authorization, and name resolution workflows, so a crash affects far more than one server.
Q: What do security teams get wrong about internal denial-of-service threats?
A: Teams often assume internal systems are safe unless an attacker has full compromise, but that assumption fails for protocol abuse.
Practitioner guidance
- Harden domain controller exposure Remove unnecessary public reachability for LDAP, CLDAP, RPC, and related services.
- Test protocol-level resource exhaustion Build abuse cases for LDAP referral chains, RPC enumeration calls, and repeated request patterns that force high memory consumption.
- Instrument identity-plane availability controls Track DC crashes, abnormal referral behavior, and spikes in authentication-related service faults as security signals, not only infrastructure incidents.
What's in the full report
SafeBreach's full research covers the technical exploit chains and proof-of-concept detail this post intentionally leaves for the source:
- The LDAP referral handling sequence that enabled Win-DDoS and the memory-exhaustion conditions behind the crash
- The three RPC abuse paths used to trigger denial of service on Windows domain controllers and endpoints
- The proof-of-concept behaviour showing how public DCs were coerced into high-volume outbound traffic
- The vendor response and disclosure timeline, including Microsoft remediation details
👉 Read SafeBreach’s analysis of Win-DoS, Win-DDoS, and Windows RPC abuse →
Win-DoS and Windows RPC abuse: what should defenders change now?
Explore further
02/08/2026 1:29 pm
Win-DDoS exposes a control-plane resilience gap, not just a network flooding problem. The research shows that domain controllers can be turned into part of the attack surface when protocol behavior is trusted too much. That matters because directory services are foundational to IAM operations, so availability failures in DCs can cascade into authentication, policy enforcement, and privileged access workflows. Practitioners should treat DC resilience as identity governance infrastructure, not only server uptime.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- 45% of organisations cite lack of credential rotation as the top cause of NHI-related attacks, with inadequate monitoring and logging and over-privileged accounts each cited by 37%.
A question worth separating out:
Q: Which controls should reduce the risk of Win-DDoS style abuse?
A: The main controls are exposure reduction, traffic filtering, protocol hardening, and availability monitoring. Security teams should restrict public access to directory services, test RPC and LDAP behaviour under abuse, and alert on crash patterns or referral anomalies. For identity programmes, resilience controls must sit alongside access controls.
👉 Read our full editorial: Win-DoS shows how RPC blind spots can turn Windows DCs into botnets
