Windows System: Kerberos KDC RC4-HMAC downgrade exploit attempts (CVE-2022-37966)
Identifies Windows Kerberos KDC error events tied to RC4-HMAC downgrade/auth negotiation exploitation behavior (CVE-2022-37966).
FreeReviewedSigma · High · v5
- Product
- windows
- Service
- system
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-09
- Updated
- 2026-07-31
What it detects
This rule flags error-level Kerberos Key Distribution Center (KDC) events that match Kerberos key distribution activity consistent with an RC4-HMAC negotiation downgrade and authentication bypass leading to privilege escalation. Attackers may leverage weak RC4-HMAC negotiation to trigger a security bypass and elevate privileges on Windows environments. The detection relies on Windows System logs for EventID 42 emitted by the Kerberos Key Distribution Center providers.
Reporting behind it
- support.microsoft.comhttps://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-37966/win_system_exploit_cve_2022_37966_kdcsvc_rc4_downgrade.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-system-event-42-kerberos-kdc-rc4-hmac-downgrade-exploit-activity-cve-202-e6f81941
title: "Windows System: Kerberos KDC RC4-HMAC downgrade exploit attempts (CVE-2022-37966)"
id: 7a71a9b5-0e56-4562-98c0-8884b09bdb9b
status: test
description: This rule flags error-level Kerberos Key Distribution Center (KDC) events that match Kerberos key distribution activity consistent with an RC4-HMAC negotiation downgrade and authentication bypass leading to privilege escalation. Attackers may leverage weak RC4-HMAC negotiation to trigger a security bypass and elevate privileges on Windows environments. The detection relies on Windows System logs for EventID 42 emitted by the Kerberos Key Distribution Center providers.
references:
- https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-37966/win_system_exploit_cve_2022_37966_kdcsvc_rc4_downgrade.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-11-09
modified: 2025-11-03
tags:
- attack.privilege-escalation
- detection.emerging-threats
- cve.2022-37966
logsource:
product: windows
service: system
detection:
selection:
EventID: 42
Provider_Name:
- Kerberos-Key-Distribution-Center
- Microsoft-Windows-Kerberos-Key-Distribution-Center
Level: 2
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: e6f81941-b1cd-4766-87db-9fc156f658ee
type: derived