Windows System Event 42: Kerberos KDC RC4-HMAC Downgrade Exploit Activity (CVE-2022-37966)

title: "Windows System Event 42: Kerberos KDC RC4-HMAC Downgrade Exploit Activity (CVE-2022-37966)"
id: 7a71a9b5-0e56-4562-98c0-8884b09bdb9b
status: test
description: This rule flags Windows System events where the Kerberos Key Distribution Center reports an error (EventID 42) during RC4-HMAC authentication negotiation, consistent with a downgrade/exploitation attempt targeting the Kerberos protocol behavior described for CVE-2022-37966. Attackers may use weaker negotiation to bypass security controls and gain elevated privileges. Detection relies on System log entries from the Kerberos-Key-Distribution-Center providers with Level=2 (Error) and EventID=42.
references:
  - https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-37966/win_system_exploit_cve_2022_37966_kdcsvc_rc4_downgrade.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-11-09
modified: 2025-11-03
tags:
  - attack.privilege-escalation
  - detection.emerging-threats
  - cve.2022-37966
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 42
    Provider_Name:
      - Kerberos-Key-Distribution-Center
      - Microsoft-Windows-Kerberos-Key-Distribution-Center
    Level: 2
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e6f81941-b1cd-4766-87db-9fc156f658ee
    type: derived