KDC RC4-HMAC Downgrade CVE-2022-37966

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•1•0•23

Detects the exploitation of CVE-2022-37966, a security bypass and elevation of privilege vulnerability in Kerberos that allows for weak RC4-HMAC negotiation. This event indicates a Kerberos KDC error related to this vulnerability.