CVE-2021-42278: Active Directory sAMAccountName Spoofing (noPac Part 1)

HERMES

HERMES THREAT SCORE & ACTIVE DIRECTORY PRIVILEGE ESCALATION

Target: Microsoft Active Directory Domain Services (AD DS / SAM)

Confidence: 99%

93 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 17 / 20

Prevalence 20 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2021-42278 at 8.8 (HIGH, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score evaluates operational impact at 93 (HIGH) due to ubiquitous Active Directory exposure and weaponization in the AI-orchestrated PaperCut campaign.

🕸️ Connected Knowledge Graph & Provenance

CVE-2021-42278: Active Directory sAMAccountName Spoofing (noPac)VULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTPaperCut MF/NG

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in PaperCut MF/NG documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Active Directory Domain Escalation: The noPac Primitive

CVSS v3.1: 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) / CWE-269: Improper Privilege Management. In CISA KEV since April 19, 2022. Chained with CVE-2021-42287 in the noPac exploit suite, enabling any authenticated domain user to seize Domain Admin privileges in seconds.

Executive Summary

CVE-2021-42278 is a privilege escalation vulnerability in Active Directory Domain Services (AD DS). By default, authenticated domain users can add up to 10 computer accounts via ms-DS-MachineAccountQuota. A validation deficiency in SAM allows renaming a controlled computer account’s sAMAccountName to omit the standard trailing $ character and match the name of a legitimate Domain Controller (e.g., DC01). When combined with CVE-2021-42287, an attacker requests Kerberos tickets resulting in total domain dominance.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2021-42278	Microsoft Security Response Center (MSRC) & CISA KEV
Affected Product	microsoft:windows	Active Directory Domain Controllers (Windows Server)
Vulnerable Component	Security Account Manager (SAM / AD DS)	sAMAccountName Validation Routine
Weakness Class	CWE-269: Improper Privilege Management	Account Spoofing / Privilege Escalation
CVSS v3.1 Score	8.8 (HIGH / Hermes Score 93)	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Remediation Updates	KB5008102, KB5008380, KB5008602	November 2021 & January 2022 Security Updates
MITRE ATT&CK	T1068 - Exploitation for Privilege Escalation, T1558 - Steal or Forge Kerberos Tickets	Privilege Escalation / Credential Access
Chained Campaign	AI-Orchestrated PaperCut Campaign	Used by autonomous agents for Domain Admin escalation

---

2. In-Depth Technical Decomposition & Root Cause

In Active Directory, computer accounts typically terminate with a dollar sign ($) (e.g. WORKSTATION01$ or DC01$). When creating or modifying a computer account object (user class with userAccountControl flag WORKSTATION_TRUST_ACCOUNT), Active Directory enforces uniqueness constraints.

However, prior to the November 2021 update, SAM failed to enforce that computer objects must end with $:

1. An attacker adds a standard machine account testpc$ using their default quota.
2. The attacker modifies the attribute sAMAccountName on testpc$ to DC01 (matching Domain Controller DC01$ without the trailing $).
3. SAM accepted DC01 because no object in the directory held the exact value DC01 (the real DC was registered as DC01$).
4. This set the stage for CVE-2021-42287, where the Kerberos KDC automatically appends a $ during service ticket requests, causing the KDC to impersonate the Domain Controller itself.

---

3. Attack Scenarios & Threat Modeling

1. Initial Access: Attacker obtains a low-privileged domain user shell (for instance, via PaperCut CVE-2026-81578 & CVE-2026-82078).
2. Machine Account Creation: Attacker creates computer account temp$.
3. Spoofing sAMAccountName (CVE-2021-42278): Attacker renames temp$ to DC01.
4. TGT Request & Re-naming: Attacker requests a Kerberos TGT for DC01, then renames the account back to temp$.
5. PAC Impersonation (CVE-2021-42287): Attacker requests a TGS via S4U2self; KDC fails to find DC01, appends $, and issues a ticket with Domain Admin privileges.

---

4. Forensic Detection & Telemetry

Inspect Windows Security Event Logs on Domain Controllers:

• Event ID 4741 (A computer account was created): Look for computer accounts created by unexpected service accounts.
• Event ID 4781 (The name of an account was changed): Monitor for changes where Old Target Name ends in $ but New Target Name does NOT end in $.

---

5. Remediation Guidelines

1. Deploy Microsoft Updates: Ensure all Domain Controllers have installed KB5008380 or later.
2. Disable Machine Account Quota: Set ms-DS-MachineAccountQuota = 0 via ADSI Edit to prevent unprivileged users from registering computer accounts.
3. Review Campaign Intel: Read our report on the AI-Orchestrated PaperCut Campaign.