Notifications
Clear all
Topic starter
02/08/2026 12:00 pm
TL;DR: CVE-2025-29969 in the MS-EVEN RPC protocol let low-privileged users write arbitrary files remotely on Windows 11 and Windows Server 2025, bypassing default C$ share limitations and enabling propagation paths inside domain networks, according to SafeBreach Labs. The finding shows why low-privilege credentials can still create high-impact identity and lateral-movement risk when service design exposes write primitives.
NHIMG editorial — based on content published by SafeBreach: EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969)
Questions worth separating out
Q: What breaks when low-privilege Windows accounts can write files through RPC services?
A: The security boundary breaks because the account can be used for more than its intended login scope.
Q: Why do low-privilege credentials still create serious lateral movement risk in Windows domains?
A: Because many domain paths are writable by broad user groups, and a remote service can act on behalf of the caller.
Q: How do security teams know whether an RPC service is exposing more authority than it should?
A: Look for remotely reachable interfaces that accept file paths, perform backup or restore functions, or return different errors based on path existence.
Practitioner guidance
- Inventory remotely reachable Windows RPC surfaces Catalog RPC services that accept low-privilege callers, then identify which interfaces expose file-path arguments, backup functions, or remote write behavior.
- Test remote file operations against low-privilege identities Validate whether a standard user can reach file existence checks, remote backup paths, or write-adjacent behavior through event log services and similar RPC interfaces.
- Remove auto-execution destinations from writable user paths Audit startup folders, per-user application paths, ProgramData, and DLL search locations for remote write exposure from low-privilege domain users.
What's in the full report
SafeBreach's full research covers the exploit mechanics this post intentionally leaves for the source:
- The RPCView workflow the researchers used to identify remotely reachable interfaces and security callback behavior
- The ElfrOpenBELW and ElfrBackupELFW call sequence that produced the hidden file existence and write primitives
- The proof-of-concept paths used to place files into Startup and DLL-hijack locations on Windows systems
- The responsible disclosure timeline, patch timing, and research repository details that support validation and testing
👉 Read SafeBreach's research on CVE-2025-29969 and Windows RPC file-write abuse →
Windows event log RPC abuse: what identity teams need to know?
Explore further
02/08/2026 1:06 pm
Low-privilege Windows credentials are only low risk until a service turns them into a write primitive. This research shows that the decisive issue is not the account label, but whether a remotely reachable service performs privileged file actions on behalf of that account. Once a service exposes hidden CreateFile-like behavior, the identity boundary changes from authentication control to propagation control. Practitioners should treat remote write as an identity event, not just a file-system event.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
A: Accountability usually spans the platform owner, the service owner, and the identity governance team. The service owner is responsible for the exposed capability, the platform owner for the default configuration, and identity teams for how those credentials are scoped in domain environments. Control ownership has to match the abuse path.
👉 Read our full editorial: Windows event log RPC abuse shows low-privilege write risk
