Windows Kerberos Key Distribution Center: CVE-2021-42278 Exploitation Attempt Indicators (Event 35–38)

Alerts on Windows Kerberos KDC ticket anomalies (EventIDs 35–38) associated with CVE-2021-42278 exploitation attempts.

FreeReviewedSigma · Medium · v5

Product: windows
Service: system
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2021-12-15
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1558.003Kerberoasting
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows system events from the Microsoft-Windows-Kerberos-Key-Distribution-Center service that match PAC/Ticket integrity anomalies associated with CVE-2021-42278 exploitation attempts. Attackers may attempt to obtain unauthorized access by manipulating Kerberos-related artifacts, which can surface as missing or inconsistent PAC/requestor information. The detection relies on telemetry from the Kerberos Key Distribution Center with Event IDs 35, 36, 37, or 38.

Reporting behind it

Related detections9 linkedT1558.003 — drag to rearrange

Malicious Kerberos Ticket File Creation Indicating Credential Theft (via file_event)

Suspicious Kerberoasting via setspn Service Principal Query

Masquerading Kerberos Ticket Abuse via Rubeus (via process_creation)

Possible Targeted Kerberoasting via servicePrincipalName Modification

Suspicious SQL Service Principal Name Enumeration via Setspn

Windows: Suspicious Kerberos Ticket Requests from PowerShell Using KerberosRequestorSecurityToken

Windows Process Creation: RemoteKrbRelay Kerberos Relay Tool Execution

Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType

Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)

Windows Kerberos Key Distribution Center: CVE-2021-42278 Exploitation Attempt Indicators (Event 35–38)

Pivot detection · T1558.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-kerberos-kdc-pac-requestor-anomaly-cve-2021-42278-exploitation-attempts-44bbff3e

title: "Windows Kerberos Key Distribution Center: CVE-2021-42278 Exploitation Attempt Indicators (Event 35–38)"
id: 60eeb6f4-844f-457f-b01f-dd093fc64871
related:
  - id: e80a0fee-1a62-4419-b31e-0d0db6e6013a
    type: similar
  - id: 44bbff3e-4ca3-452d-a49a-6efa4cafa06f
    type: derived
status: test
description: This rule flags Windows system events from the Microsoft-Windows-Kerberos-Key-Distribution-Center service that match PAC/Ticket integrity anomalies associated with CVE-2021-42278 exploitation attempts. Attackers may attempt to obtain unauthorized access by manipulating Kerberos-related artifacts, which can surface as missing or inconsistent PAC/requestor information. The detection relies on telemetry from the Kerberos Key Distribution Center with Event IDs 35, 36, 37, or 38.
references:
  - https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-42278/win_system_exploit_cve_2021_42278.yml
author: frack113, Huntrule Team
date: 2021-12-15
modified: 2023-04-14
tags:
  - attack.credential-access
  - attack.t1558.003
  - cve.2021-42278
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Microsoft-Windows-Kerberos-Key-Distribution-Center
    EventID:
      - 35
      - 36
      - 37
      - 38
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL