Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966

title: Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966
id: e6f81941-b1cd-4766-87db-9fc156f658ee
status: test
description: Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation
references:
    - https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d
author: Florian Roth (Nextron Systems)
date: 2022-11-09
modified: 2025-11-03
tags:
    - attack.privilege-escalation
    - detection.emerging-threats
    - cve.2022-37966
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 42
        Provider_Name:
            - 'Kerberos-Key-Distribution-Center'
            - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
        Level: 2  # Error
    condition: selection
falsepositives:
    - Unknown
level: high