Potential CVE-2021-42278 Exploitation Attempt

Description

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Query · sigma

selection:
  Provider_Name: Microsoft-Windows-Kerberos-Key-Distribution-Center
  EventID:
  - 35
  - 36
  - 37
  - 38
condition: selection

Known false positives

  • Unknown
Raw source Potential CVE-2021-42278 Exploitation Attempt · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Potential CVE-2021-42278 Exploitation Attempt
id: 44bbff3e-4ca3-452d-a49a-6efa4cafa06f
related:
    - id: e80a0fee-1a62-4419-b31e-0d0db6e6013a
      type: similar
status: test
description: |
    The attacker creates a computer object using those permissions with a password known to her.
    After that she clears the attribute ServicePrincipalName on the computer object.
    Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.
references:
    - https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
author: frack113
date: 2021-12-15
modified: 2023-04-14
tags:
    - attack.credential-access
    - attack.t1558.003
    - cve.2021-42278
    - detection.emerging-threats
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Microsoft-Windows-Kerberos-Key-Distribution-Center'  # Active Directory
        EventID:
            - 35 # PAC without attributes
            - 36 # Ticket without a PAC
            - 37 # Ticket without Requestor
            - 38 # Requestor Mismatch
    condition: selection
falsepositives:
    - Unknown
level: medium

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.