CVE-2021-42278

What it actually does

CVE-2021-42278 is an Active Directory Domain Services privilege escalation flaw involving improper validation of the sAMAccountName attribute for computer accounts. A low-privileged authenticated domain user can manipulate or create a computer account with a spoofed name that resembles a domain controller account. In common real-world exploitation, this is chained with Kerberos behavior addressed by CVE-2021-42287 to confuse the Key Distribution Center and obtain tickets that allow impersonation of privileged domain identities, potentially leading to domain administrator-level access.

Why it matters to the business

Successful exploitation can result in full Active Directory domain compromise, allowing attackers to take control of users, servers, domain controllers, Group Policy, and business-critical applications that rely on domain authentication. Because this vulnerability is in CISA KEV, has been exploited in the wild, has a high EPSS score, and is associated with ransomware activity, unpatched domain controllers represent a material risk of enterprise-wide outage, data theft, destructive activity, and ransomware deployment. The CISA remediation due date of 2022-05-02 has long passed, so any remaining exposure should be treated as urgent technical debt.

How an attack unfolds

An attacker first obtains any valid low-privileged Active Directory credentials. If the domain allows ordinary users to create or modify computer accounts, the attacker creates or takes control of a machine account and changes its sAMAccountName to mimic a domain controller name, typically by removing or manipulating the trailing dollar sign convention used by computer accounts. The attacker then requests Kerberos tickets in a way that causes the domain controller to resolve the spoofed account as if it were the real domain controller account. When chained with the related Kerberos privilege escalation behavior, the attacker can obtain service tickets that enable impersonation of highly privileged identities. With that access, the attacker can perform actions such as DCSync, dump credential material, modify Group Policy, create privileged accounts, disable security controls, and deploy ransomware or other payloads across domain-joined systems.

How to fix it

Apply the Microsoft security updates released for CVE-2021-42278 to all affected Windows Server domain controllers, including Windows Server 2008, 2012, 2016, 2019, 2022, version 2004, and 20H2 where applicable. Because fixed versions were not provided in the input, use the vendor security update guidance and ensure all domain controllers have at least the November 2021 cumulative updates or later supported cumulative updates installed. Patch every writable and read-only domain controller; partial patching can leave the domain exposed. Also review and reduce abuse paths by setting ms-DS-MachineAccountQuota to 0 or another tightly controlled value where operationally feasible, restricting who can create computer accounts, reviewing delegated permissions that allow computer account creation or sAMAccountName modification, and monitoring or blocking unusual computer account renames. If legacy unsupported Windows Server versions remain, prioritize retirement, isolation, or extended security update coverage.

How to confirm the fix worked

Confirm every domain controller has the relevant Microsoft security update or a later cumulative update installed. Validate using Microsoft update inventory, endpoint management tooling, or direct host checks for installed cumulative updates. Confirm there are no unpatched domain controllers, including read-only domain controllers and domain controllers in remote sites. Review Active Directory configuration to verify that ms-DS-MachineAccountQuota is not left at the default value of 10 unless explicitly required. Test exposure in a controlled manner by verifying that low-privileged users cannot create arbitrary computer accounts or rename computer accounts to domain-controller-like sAMAccountName values. Review recent directory changes for suspicious computer account creation, renaming, or sAMAccountName changes around the time of any suspected activity.

Typical attack path

1. Obtain valid low-privileged Active Directory credentials through phishing, credential reuse, malware, or prior compromise.
2. Query Active Directory to identify domain controllers and naming conventions for computer accounts.
3. Create a new computer account or use a controlled computer account if permissions allow it.
4. Modify the computer account sAMAccountName to spoof a domain controller-style name, commonly manipulating the trailing dollar sign.
5. Request Kerberos authentication material for the spoofed account.
6. Chain the spoofing condition with Kerberos ticket confusion behavior to obtain elevated service tickets.
7. Use the elevated Kerberos tickets to access domain controller services as a privileged identity.
8. Perform domain dominance actions such as DCSync, credential dumping, privileged account creation, Group Policy modification, or lateral movement.
9. Deploy follow-on payloads, including ransomware, data theft tooling, or persistence mechanisms.

How to detect it

Hunt primarily in domain controller Security logs, Directory Service logs, Kerberos authentication events, endpoint EDR telemetry from domain controllers, and Active Directory change auditing. Look for low-privileged users creating computer accounts followed by rapid account renames, especially to names resembling domain controllers or names that add or remove a trailing dollar sign. Review Event ID 4741 for computer account creation, Event ID 4781 for account name changes, Event ID 4742 for computer account changes, Event ID 4768 for Kerberos TGT requests, and Event ID 4769 for service ticket requests. Suspicious sequences include a newly created computer account renamed to a domain-controller-like name, Kerberos ticket requests immediately after the rename, and then a rename back to the original machine account. Also search for use of public exploitation tooling such as noPac or sam-the-admin in command lines, process names, script content, downloaded files, or web proxy logs. If exploitation is suspected, examine whether the attacker performed DCSync, accessed domain controller administrative shares, modified Group Policy, created new privileged users, disabled security tooling, or staged ransomware. Because this issue has been used in ransomware campaigns, expand detection to include credential dumping, unusual replication requests, mass lateral movement, and abnormal administrative logons after the suspected Kerberos activity.

• Event ID 4741
• Event ID 4742
• Event ID 4781
• Event ID 4768
• Event ID 4769
• A computer account was created
• A computer account was changed
• The name of an account was changed
• Account Name: *$
• Old Account Name: *$
• New Account Name: *$
• Service Name: krbtgt
• Service Name: cifs/
• Service Name: ldap/
• Service Name: HOST/
• noPac
• sam-the-admin
• sAMAccountName
• ms-DS-MachineAccountQuota
• DCSync
• DRSGetNCChanges
• lsadump::dcsync

What your security team should do

• Immediately verify patch status for all domain controllers; treat any unpatched domain controller as a high-priority incident-risk exposure because the vulnerability is KEV-listed and associated with ransomware activity.
• Hunt for historical exploitation using domain controller security logs, directory service change logs, Kerberos authentication logs, and endpoint telemetry for suspicious computer account creation, renaming, and Kerberos ticket activity.
• Set ms-DS-MachineAccountQuota to 0 or a controlled value, and restrict computer account creation to authorized provisioning processes.
• Review delegated Active Directory permissions that allow modification of computer account attributes, especially sAMAccountName, servicePrincipalName, and DNS host name attributes.
• Monitor for Event ID 4741, 4742, 4781, 4768, and 4769 patterns involving newly created or recently renamed computer accounts and domain-controller-like names.
• Investigate any computer account whose name resembles a domain controller name, lacks an expected trailing dollar sign, was rapidly renamed, or was created by a non-administrative user.
• If suspicious activity is found, assume possible domain compromise and perform incident response steps including Kerberos ticket invalidation, privileged credential rotation, KRBTGT reset planning, domain controller forensic review, and validation of Group Policy integrity.
• Prioritize hardening and monitoring of Active Directory because exploitation can lead directly to enterprise-wide control and ransomware deployment.