Potential CVE-2021-42278 Exploitation Attempt
This rule detects potential exploitation attempts of CVE-2021-42278, also known as "noPac" or "sAMAccountName spoofing". The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName (SPN) attribute. This manipulation grants the attacker additional permissions on the object, allowing them to make further changes. The detection logic specifically looks for Kerberos Key Distribution Center (KDC) events (EventIDs 35, 36, 37, 38) which indicate anomalies in PAC (Privilege Attribute Certificate) or ticket requests, consistent with the post-exploitation phase of CVE-2021-42278 where forged tickets are used.
Sigma
