Proof of Concept code has been published showing how to exploit two vulnerabilities that would allow an attacker to obtain domain admin privilege on your Windows Domain Controllers.
In the November security patch bundle, Microsoft released patches to resolve two vulnerabilities ( CVE-2021-42287 and CVE-2021-42278 ) in the Windows Active Directory Domain Services. On December 12th a proof of concept was publicly disclosed which demonstrates how to leverage those vulnerabilities leading Microsoft to publish a warning:
When combining these two vulnerabilities, an attacker can create a straightforward path to a Domain Admin user in an Active Directory environment that hasn’t applied these new updates. This escalation attack allows attackers to easily elevate their privilege to that of a Domain Admin once they compromise a regular user in the domain
The Microsoft Defender for Identity Security team has now published details of how to search your event logs for evidence that these vulnerabilities were exploited before patches were applied to your domain controller – by searching for event 4662 which is generated when the sAMAccountName is changed for a device, an essential step in exploiting these vulnerabilities. The relevant Advanced Hunting query is also available on GitHub.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)