Microsoft · Kerberos Key Distribution Center (KDC)
The Kerberos Key Distribution Center (KDC) in Microsoft Kerberos Key Distribution Center contains a privilege escalation flaw, in which a forged signature in a ticket is accepted, affecting Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2. An attacker with network access and valid low-privilege domain user credentials can forge a ticket signature to obtain domain administrator privileges, with no user interaction required.
The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."
First seen exploited the day it was disclosed. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
authenticated domain user abuses valid domain account
allows remote authenticated domain users to obtain domain administrator privileges
forged Kerberos ticket signature enables credential forgery
via a forged signature in a ticket
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2014-6324 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…w64.log >ppp.log2016-10-03T09:30:10 PowerShell.exe -ExecutionPolicy Bypass -File getpwd.ps1 >iistail.log In another example, BRONZE UNION leveraged the Kekeo credential abuse tool to exploit CVE-2014-6324, a vulnerability in Microsoft's implementation of the Kerberos network authentication…
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.