In October 2025, Microsoft published a security advisory for CVE-2025-59230, an elevation-of-privilege flaw in the Windows Remote Procedure Call (RPC) runtime that allows an authenticated attacker to coerce and reflect NTLM authentication to gain SYSTEM-level access. By early 2026, multiple ransomware operators had integrated the technique into post-exploitation toolchains, using it to move from a low-privileged foothold to domain-wide encryption. This article breaks down the vulnerability, the attacker TTPs, and the detection and mitigation steps defenders can implement today.
Background: What Is CVE-2025-59230?
CVE-2025-59230 is an elevation-of-privilege (EoP) vulnerability in the Windows RPC runtime, specifically in the way the RPC endpoint mapper handles NTLM authentication tokens during certain RPC calls. An attacker who has already obtained a low-privileged domain account can coerce a privileged service to authenticate to an attacker-controlled RPC endpoint, then reflect that authentication back to the local machine to obtain a SYSTEM token. Microsoft rates this as Important with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability was addressed in the October 2025 Patch Tuesday updates. Microsoft's advisory is available at MSRC Update Guide.
The flaw is a variant of the classic NTLM reflection attack class that has resurfaced repeatedly because RPC endpoints often run as SYSTEM and accept NTLM authentication by default. Unlike SMB-based relaying, which is frequently blocked by SMB signing, RPC-based reflection can bypass many network-level controls because the authentication stays local to the host. This makes it particularly attractive to ransomware affiliates who already have a beachhead and need to escalate quickly.
Affected Versions and Patch Status
According to the Microsoft advisory, the following platforms are affected prior to the October 2025 updates:
- Windows 10 (all supported builds prior to October 2025 cumulative update)
- Windows 11 22H2, 23H2, 24H2 (prior to October 2025 cumulative update)
- Windows Server 2016, 2019, 2022, 2025 (prior to October 2025 cumulative update)
The patched builds are distributed through the standard Windows Update channel. Administrators should verify that the October 2025 cumulative update (or later) is installed. Microsoft's update guide contains the exact KB numbers per build; these are subject to revision, so always confirm against the MSRC advisory. For organizations that cannot patch immediately, Microsoft recommends enabling RPC endpoint hardening and restricting NTLM authentication where feasible.
At the time of writing, CVE-2025-59230 has not been added to CISA's Known Exploited Vulnerabilities catalog, but multiple threat-intel vendors have reported exploitation in ransomware intrusions. Defenders should treat it as exploited-in-the-wild based on those reports.
Attacker TTPs: From Foothold to SYSTEM
The exploitation chain observed in public incident reports follows a consistent pattern that maps to MITRE ATT&CK techniques.
1. Initial Access and Discovery (T1078, T1087)
Attackers typically arrive via valid accounts obtained from prior phishing, infostealer logs, or purchased access. They perform domain and local discovery using built-in tools such as net, whoami, and nltest to identify RPC services running as SYSTEM and to enumerate domain trusts.
2. Coercion and Reflection (T1187, T1557.001)
The core of the exploit is a coercion-and-reflection sequence. The attacker uses an RPC client to trigger a privileged service to authenticate to an attacker-controlled endpoint, then relays that NTLM authentication back to a local RPC interface that accepts NTLM. Because the authentication originates from the local machine, SMB signing and network segmentation do not prevent it. This is a local variant of NTLM relay (ATT&CK T1557.001) combined with forced authentication (T1187).
3. Token Theft and Impersonation (T1134)
Once the reflected authentication succeeds, the attacker obtains a SYSTEM token and can impersonate it. Tools such as Rubeus and custom RPC clients have been observed in public reporting. The attacker then uses the SYSTEM context to disable defenses, dump credentials (T1003), and deploy ransomware.
4. Impact (T1486)
With SYSTEM and often domain-admin privileges, the attacker pushes ransomware via GPO, PsExec, or remote service creation. The encryption phase is typically preceded by deletion of shadow copies (vssadmin delete shadows /all /quiet) and disabling of recovery features.
Detection: Sigma Rule for RPC Coercion and Reflection
The following Sigma rule detects suspicious RPC client activity associated with known coercion tools and anomalous local NTLM authentication to RPC endpoints. It is designed to be tuned in your environment.
title: Suspicious RPC Coercion and NTLM Reflection Activity
description: Detects potential exploitation of CVE-2025-59230 via RPC coercion and local NTLM reflection.
status: experimental
author: CybernytronX
logsource:
product: windows
service: security
detection:
selection_auth:
EventID: 4624
LogonType: 3
AuthenticationPackageName: NTLM
TargetUserName|endswith: '$'
selection_rpc:
EventID: 5156
Application|contains:
- 'rpcss'
- 'epmapper'
Direction: 'Inbound'
condition: selection_auth and selection_rpc
falsepositives:
- Legitimate RPC traffic from management tools
level: high
In addition, monitor for the following indicators:
- Unusual processes opening RPC endpoints on high ports (e.g.,
rpcping.exeor custom binaries). - Event ID 4624 with
LogonType 3andAuthenticationPackageName NTLMfrom a local source IP (127.0.0.1 or the host's own IP). - Creation of services or scheduled tasks immediately following such logons (Event IDs 7045, 4698).
For network-level detection, a Suricata rule can flag NTLMSSP negotiation over non-standard RPC ports:
alert tcp any any -> any any (msg:"Possible NTLM Reflection over RPC"; flow:to_server,established; content:"NTLMSSP"; depth:8; content:"|0b|rpc"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)
Note: The Suricata rule above is illustrative; validate and tune before production use.
Mitigation: Patch, Harden, and Monitor
Microsoft's primary guidance is to apply the October 2025 cumulative update. Beyond patching, the following hardening steps reduce the attack surface:
- Enable RPC endpoint hardening: Use the
RpcRestrictRemoteClientsandRpcServerUseProtseqregistry settings to restrict remote RPC clients. Microsoft documents these in the RPC security documentation. - Disable NTLM where possible: Move to Kerberos-only authentication. Microsoft's Network security: Restrict NTLM policy can be applied in audit mode first.
- Enforce SMB signing and EPA: While not a direct fix, these controls limit relay paths that often accompany RPC coercion.
- Apply the principle of least privilege: Remove unnecessary local admin rights and restrict service accounts.
- Monitor for coercion tools: Block or alert on known tools like
PetitPotam,DFSCoerce, andRubeusvia application allowlisting.
For environments that cannot immediately patch, consider network segmentation to isolate critical RPC services and implement strict firewall rules to limit RPC traffic to trusted management hosts.
Why This Matters for Defenders
CVE-2025-59230 is a reminder that elevation-of-privilege flaws in core Windows services remain a high-value target for ransomware operators. The vulnerability does not require a zero-day; it abuses legitimate RPC and NTLM behavior that is often overlooked in hardening baselines. Defenders who focus only on perimeter and email security will miss the post-exploitation phase where this exploit lives. Effective defense requires visibility into local authentication events, RPC endpoint activity, and the ability to correlate them. Organizations should also review their NTLM usage and accelerate Kerberos migration. Finally, because the exploit is local, EDR telemetry and Windows Security logs are critical; ensure they are collected and retained for at least 30 days to support incident response.
Sources
- Microsoft Security Response Center – CVE-2025-59230 Update Guide — Official advisory with affected versions, CVSS score, and patch details.
- CISA Known Exploited Vulnerabilities Catalog — Check for any future addition of CVE-2025-59230 to the KEV list.
- Microsoft Learn – Restricting Remote RPC Clients — Guidance on RPC endpoint hardening.
- Microsoft Learn – Network security: Restrict NTLM — Policy settings to limit NTLM authentication.
Frequently Asked Questions
Is CVE-2025-59230 being actively exploited?
Yes. Multiple threat-intel vendors and incident-response firms have reported exploitation in ransomware intrusions. Microsoft has not confirmed active exploitation in its advisory, but the pattern of use aligns with post-exploitation tooling. Check the CISA KEV catalog for updates.
Does patching alone fully mitigate the risk?
Patching closes the specific vulnerability, but the underlying NTLM reflection technique can still be abused via other coercion vectors. Organizations should also restrict NTLM, enable RPC hardening, and monitor for coercion tools.
What log sources are most useful for detection?
Windows Security Event ID 4624 (logon type 3 with NTLM), Event ID 5156 (Windows Filtering Platform), and EDR telemetry for RPC endpoint creation and process injection are key. Correlate these with service creation (7045) and scheduled task creation (4698).
Can this be exploited remotely without credentials?
No. The attacker must already have a low-privileged domain account or local access. It is an elevation-of-privilege vulnerability, not a remote code execution flaw.
Are there any workarounds if I cannot patch immediately?
Yes. Microsoft recommends restricting RPC clients, disabling NTLM where possible, and segmenting networks. These reduce the attack surface but do not eliminate the vulnerability. Patch as soon as feasible.
Need expert help with this?
If your organization needs to validate exposure to CVE-2025-59230 or harden RPC and NTLM configurations, CybernytronX can help. Our penetration testing and SOC build-out services identify and close privilege-escalation gaps before ransomware operators do. For continuous detection, Ethereon AI threat detection correlates local authentication anomalies with RPC activity. Contact us at cybernytronx.com/contact.html or explore Ethereon to see how we can support your team.