CVE-2021-42278

CVE-2021-42278 is an elevation of privilege flaw in Microsoft Active Directory Domain Services (AD DS) caused by improper handling of changes to a computer account's sAMAccountName, allowing an attacker to 'spoof' a domain controller's name. A low-privileged authenticated user who can create or rename computer accounts (possible by default for ordinary domain users under MachineAccountQuota) renames a machine account to match a domain controller, obtains a Kerberos ticket for that name, and — typically chained with the related flaw CVE-2021-42287 — impersonates the domain controller to gain domain administrator rights. Successful exploitation yields full control of the Active Directory domain, which attackers, including ransomware operators, use to move laterally and deploy ransomware. Any organization running Active Directory on the affected Windows Server releases is exposed, though only servers with the AD DS role (domain controllers) reachable by an attacker with valid domain credentials are directly exploitable. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 with known ransomware use, and EPSS assigns a 73.3% probability of exploitation within 30 days.

What to do: Apply the Microsoft security updates for Active Directory Domain Services (released November 2021) to every domain controller, per CISA's required action. Until patched, restrict who can create or rename computer accounts (e.g., reduce MachineAccountQuota from the default 10) and audit domain controllers for renamed machine accounts and anomalous Kerberos tickets issued for domain controller names lacking the trailing '$'. Because CISA notes known ransomware use, hunt for signs of this flaw being chained with CVE-2021-42287 (the noPac technique) and for any new domain-admin activity on DCs.