Windows Kerberos KDC PAC/Requestor Anomaly CVE-2021-42278 Exploitation Attempts

Alerts on Windows Kerberos KDC ticket anomalies (EventIDs 35–38) associated with CVE-2021-42278 exploitation attempts.

FreeUnreviewedSigmamediumv1

windows-kerberos-kdc-pac-requestor-anomaly-cve-2021-42278-exploitation-attempts-44bbff3e

title: Windows Kerberos KDC PAC/Requestor Anomaly CVE-2021-42278 Exploitation Attempts
id: 60eeb6f4-844f-457f-b01f-dd093fc64871
related:
  - id: e80a0fee-1a62-4419-b31e-0d0db6e6013a
    type: similar
  - id: 44bbff3e-4ca3-452d-a49a-6efa4cafa06f
    type: derived
status: test
description: This rule flags Windows System events from the Microsoft-Windows-Kerberos-Key-Distribution-Center indicating Kerberos ticket anomalies consistent with CVE-2021-42278 exploitation attempts. Attackers may manipulate Active Directory computer objects and authentication flows so the KDC issues tickets lacking expected PAC or requestor context. The detection relies on Kerberos KDC telemetry (Provider_Name) and specific event IDs signaling PAC absence, ticket without PAC, missing Requestor, or Requestor mismatch.
references:
  - https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-42278/win_system_exploit_cve_2021_42278.yml
author: frack113, Huntrule Team
date: 2021-12-15
modified: 2023-04-14
tags:
  - attack.credential-access
  - attack.t1558.003
  - cve.2021-42278
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Microsoft-Windows-Kerberos-Key-Distribution-Center
    EventID:
      - 35
      - 36
      - 37
      - 38
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags Windows System events from the Microsoft-Windows-Kerberos-Key-Distribution-Center indicating Kerberos ticket anomalies consistent with CVE-2021-42278 exploitation attempts. Attackers may manipulate Active Directory computer objects and authentication flows so the KDC issues tickets lacking expected PAC or requestor context. The detection relies on Kerberos KDC telemetry (Provider_Name) and specific event IDs signaling PAC absence, ticket without PAC, missing Requestor, or Requestor mismatch.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.