Sigma rule: Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-9bf02b408205, updated 2025-11-03T00:00:00.000Z.

Rule

Title: Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966
Status: test
Level: high
Author: Florian Roth (Nextron Systems)
Date: 2022-11-09
Modified: 2025-11-03
File: rules-emerging-threats/2022/Exploits/CVE-2022-37966/win_system_exploit_cve_2022_37966_kdcsvc_rc4_downgrade.yml
Commit: ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation

Log source

product: windows
service: system

Detection

selection:
    EventID: 42
    Provider_Name:
        - 'Kerberos-Key-Distribution-Center'
        - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
    Level: 2  # Error
condition: selection

False positives (as the rule lists them)

Unknown

CVEs this rule names

CVE-2022-37966

References

https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2022/Exploits/CVE-2022-37966/win_system_exploit_cve_2022_37966_kdcsvc_rc4_downgrade.yml

Sources and licences

SigmaHQ
"Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966" by Florian Roth (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2022/Exploits/CVE-2022-37966/win_system_exploit_cve_2022_37966_kdcsvc_rc4_downgrade.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966",
entity page, dataset version ref-9bf02b408205, updated 2025-11-03T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/e6f81941-b1cd-4766-87db-9fc156f658ee (accessed 2026-11-03).
Underlying source: SigmaHQ rule e6f81941-b1cd-4766-87db-9fc156f658ee, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.