Windows PnP USB Emulation Chained to SYSTEM Privilege Escalation on Win11

Tue, 11 Aug 2026 11:54:43 +0000

Engineer — Plan: The RDP USB-redirection vector means physical access is not required, making this relevant to any enterprise RDP deployment on Windows 11. No patch or KEV yet, but audit Group Policy now to restrict or disable PnP/USB redirection over Remote Desktop where it isn’t operationally required.
SOC/IR — Plan: No IOCs or active exploitation are confirmed, but the technique produces detectable PnP driver installation events tied to RDP sessions; queue a detection rule for unexpected signed-driver installs initiated from RDP-redirected device paths as a hunting lead.
Leader — Learn: Research-stage local privilege escalation against fully patched Windows 11; no active exploitation or regulatory trigger yet — file for awareness and revisit if Microsoft issues a patch or exploitation reports emerge.

Rdp on CuraSec