CVE-2021-36942

What it actually does

CVE-2021-36942 is a Windows Local Security Authority spoofing flaw that can be abused remotely without authentication to coerce a Windows server, including domain controllers, into initiating NTLM authentication to an attacker-controlled system. In common attack chains, the coerced NTLM authentication is relayed to services that accept NTLM, such as Active Directory Certificate Services web enrollment endpoints, allowing the attacker to obtain certificates or authenticated access as the targeted machine account. The direct impact is credential/authentication material exposure and identity impersonation rather than code execution by the vulnerability itself.

Why it matters to the business

Successful exploitation can let an attacker escalate from unauthenticated network access to domain-level compromise when NTLM relay paths are available, especially in environments using vulnerable Windows Server versions and AD CS configurations. Because this issue is in CISA KEV, has been observed actively exploited, has ransomware association, and has a high EPSS score, unpatched or weakly configured systems should be treated as high-priority exposure that can lead to ransomware deployment, theft of sensitive data, and widespread disruption of Windows domain operations.

How an attack unfolds

An attacker with network reachability to a vulnerable Windows server sends crafted RPC traffic to abuse the LSA/EFSRPC behavior and force the server to authenticate outbound using NTLM. The attacker captures that NTLM authentication attempt and relays it to another internal service that accepts NTLM authentication, commonly an AD CS web enrollment or certificate enrollment endpoint. If the relayed identity is a domain controller or privileged machine account and the certificate service permits the request, the attacker can obtain a certificate or session representing that identity. The attacker can then use the resulting authentication capability to access directory services, escalate privileges, establish persistence, and move laterally. This flaw has long-standing public exploitation knowledge and is known in ransomware-relevant attack chains, so exposure should be assumed exploitable where patches and NTLM relay mitigations are absent.

How to fix it

Apply Microsoft security updates from August 2021 or later, and keep all affected Windows Server versions fully current with cumulative updates. Because the vulnerability is commonly exploited as part of an NTLM relay chain, also harden authentication paths: disable NTLM where feasible; enforce SMB signing; require LDAP signing and LDAP channel binding; enable Extended Protection for Authentication on IIS and AD CS web enrollment endpoints; disable or restrict AD CS HTTP web enrollment if not required; require HTTPS for enrollment services; and review certificate templates to prevent machine-account or low-privilege enrollment paths that could enable domain escalation. For legacy Windows Server 2008, 2012, 2016, 2019, 2004, and 20H2 systems, prioritize patch verification or decommissioning if they cannot receive supported updates.

How to confirm the fix worked

Confirm that all Windows Server systems have cumulative updates from August 2021 or later installed and are no longer missing the relevant Microsoft security update for CVE-2021-36942. Validate that domain controllers and certificate services are not susceptible to NTLM relay by testing that AD CS web enrollment and other NTLM-accepting services require Extended Protection, signing, channel binding, or have NTLM disabled. Review IIS/AD CS configuration for HTTPS-only enrollment and Extended Protection settings. Use vulnerability scanning, authenticated patch inventory, and controlled internal relay-resistance testing to verify both patch status and compensating controls.

Typical attack path

1. Identify reachable Windows Server or domain controller systems exposing RPC/SMB services.
2. Trigger LSA/EFSRPC behavior to coerce the target server to initiate NTLM authentication to attacker-controlled infrastructure.
3. Capture the inbound NTLM authentication attempt from the targeted server or domain controller machine account.
4. Relay the NTLM authentication to a service that accepts NTLM, such as AD CS web enrollment, LDAP, SMB, or another internal endpoint lacking relay protections.
5. Obtain an authenticated session or certificate for the relayed machine identity.
6. Use the certificate or session to authenticate to Active Directory services and elevate access.
7. Move laterally, access sensitive resources, deploy persistence, or support ransomware operations.

How to detect it

Look for evidence of coerced NTLM authentication followed by relay activity. Useful sources include Windows Security logs on domain controllers and servers, SMB/RPC telemetry, Windows event logs for named pipe access, IIS logs on AD CS web enrollment servers, Certificate Services operational logs, domain controller authentication logs, EDR network/process telemetry, and firewall/proxy records. Hunt for machine-account NTLM logons to unusual hosts, especially outbound authentication from domain controllers or servers to workstations, unknown systems, or attacker-controlled infrastructure. Review Security event IDs 4624 and 4776 for NTLM authentication by accounts ending in '$' from unusual source addresses; event 5145 for access to LSARPC/EFSRPC named pipes; AD CS events 4886 and 4887 for unexpected certificate requests or issued certificates; and IIS requests to /certsrv/ endpoints that coincide with NTLM relay timing. Investigate any certificate enrollment for domain controller, machine, or high-privilege templates that was not part of expected operations. Network detections should look for MS-EFSRPC/LSARPC coercion traffic followed shortly by NTLM authentication to web enrollment, LDAP, SMB, or HTTP services. If suspicious activity is confirmed, revoke questionable certificates, check for unauthorized Kerberos/PKINIT use, review privileged group changes, and perform broader lateral movement and ransomware staging hunts.

• EfsRpcOpenFileRaw
• EfsRpcEncryptFileSrv
• MS-EFSRPC
• \\PIPE\\efsrpc
• \\PIPE\\lsarpc
• /certsrv/certfnsh.asp
• /certsrv/certnew.cer
• /certsrv/certrqxt.asp
• /certsrv/
• POST /certsrv/certfnsh.asp
• POST /certsrv/certrqxt.asp
• NTLMSSP
• Event ID 4624
• Event ID 4776
• Event ID 5145
• Event ID 4886
• Event ID 4887
• PetitPotam
• ntlmrelayx.py
• rpcdump.py
• certipy
• Certipy
• DomainController
• Machine

What your security team should do

• Immediately inventory Windows Server 2008, 2012, 2016, 2019, 2004, and 20H2 systems, especially domain controllers and AD CS servers, and verify they are fully patched.
• Prioritize remediation because the issue is in CISA KEV, has ransomware association, is actively exploited in the wild, and has a high EPSS likelihood of exploitation.
• Harden or disable NTLM authentication paths, starting with AD CS web enrollment, LDAP, SMB, IIS, and other high-value internal services.
• Enable Extended Protection for Authentication on AD CS/IIS services and enforce SMB signing, LDAP signing, and LDAP channel binding.
• Audit AD CS templates and enrollment permissions for paths that allow machine-account or low-privilege enrollment to produce certificates usable for domain escalation.
• Monitor for coerced authentication and NTLM relay indicators, including unusual machine-account logons, certificate requests, and RPC activity involving EFSRPC/LSARPC named pipes.
• Investigate any unexpected certificates issued to domain controllers, servers, or machine accounts around the time of suspicious NTLM activity.
• If exploitation is suspected, rotate affected machine account secrets as appropriate, review issued certificates, revoke suspicious certificates, and perform domain compromise assessment.