Microsoft · Active Directory
The flaw is an elevation of privilege vulnerability in Microsoft Active Directory Domain Services, a component of Active Directory, stemming from improper input validation. An attacker holding low-privilege credentials on the network can exploit it without any user interaction, with success depending on a high-complexity attack condition, to gain elevated privileges.
Active Directory Domain Services Elevation of Privilege Vulnerability
First seen exploited 5 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 31 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Escalated privileges enable use of valid accounts
Active Directory Domain Services Elevation of Privilege Vulnerability
Vulnerability itself is privilege escalation via exploitation
Active Directory Domain Services Elevation of Privilege Vulnerability
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2021-42278 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
The vulnerability labelled as CVE-2021-42278 enables an attacker with limited domain user credentials to obtain a Kerberos service ticket for the domain controller, ultimately allowing them to compromise the domain controller.
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.