Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966

Status: test
Severity: high
Log source: product windows, service system
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	No specific technique

Telemetry coverage

Provider	Record / event type
Kerberos-Key-Distribution-Center	Event ID 42: The Kerberos Key Distribution Center lacks strong keys for account

Rule body

title: Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966
id: e6f81941-b1cd-4766-87db-9fc156f658ee
status: test
description: Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation
references:
    - https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d
author: Florian Roth (Nextron Systems)
date: 2022-11-09
modified: 2025-11-03
tags:
    - attack.privilege-escalation
    - detection.emerging-threats
    - cve.2022-37966
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 42
        Provider_Name:
            - 'Kerberos-Key-Distribution-Center'
            - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
        Level: 2  # Error
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 42
    Provider_Name:
        - 'Kerberos-Key-Distribution-Center'
        - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
    Level: 2

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Level`	eq	`2` corpus 2 (sigma 2)	`field:"Level" kind:eq value:"2"`
`Provider_Name`	eq	`Kerberos-Key-Distribution-Center` corpus 3 (sigma 3) `Microsoft-Windows-Kerberos-Key-Distribution-Center` corpus 4 (sigma 4)	`field:"Provider_Name" kind:eq`