Coverage for July 2021 CVE-2021-36934 "HiveNightmare/SeriousSAM" vulnerability

Technical Articles ID: KB94710
Last Modified: 2023-07-06 09:23:33 Etc/GMT

Environment

Endpoint Security (ENS) Threat Prevention 10.x

Summary

Recent updates to this article

Date	Update
July 6, 2023	Minor formatting updates; no content changes.

We're aware of the "HiveNightmare/SeriousSAM" vulnerability, CVE-2021-36934, and we're investigating product countermeasures. This article will be updated as we learn more.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Workaround 1

To block the vulnerability from being exploited, you can implement the following ENS user-defined Expert Rule.

Rule Name	Block CVE-2021-36934: 'HiveNightmare/SeriousSam'
Severity	High
Action	Block Report
Rule type	Files
Rule content	Rule { Process { Include AggregateMatch -xtype "ex1" { Exclude VTP_PRIVILEGES -type BITMASK { -v 0x8 } } Include AggregateMatch -xtype "ex2" { Exclude GROUP_SID { -v "S-1-16-16384" } Exclude GROUP_SID { -v "S-1-16-12288" } } Include AggregateMatch -xtype "ex3" { Exclude OBJECT_NAME { -v "vssadmin.exe" } } } Target { Match FILE { Include OBJECT_NAME { -v "\\windows\\system32\\config\\SAM" } Include OBJECT_NAME { -v "\\windows\\system32\\config\\SYSTEM" } Include OBJECT_NAME { -v "\\windows\\system32\\config\\SOFTWARE" } Include OBJECT_NAME { -v "\\windows\\system32\\config\\SECURITY" } Include -access "READ" } } }

Workaround 2

Microsoft's Security Response Center recommends restricting access to the contents of %windir%\system32\config\ and deleting any Volume Shadow Copy Service (VSS) shadow copies that were created before restricting access. For more information, see the Microsoft update guide on CVE-2021-36934.

Related Information

Microsoft Security Response Center: Microsoft update guide on CVE-2021-36934
Mitre CVE: CVE-2021-36934

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Coverage for July 2021 CVE-2021-36934 "HiveNightmare/SeriousSAM" vulnerability

Environment

Summary

Workaround 1

Workaround 2

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Coverage for July 2021 CVE-2021-36934 "HiveNightmare/SeriousSAM" vulnerability

Environment

Summary

Workaround 1

Workaround 2

Related Information

Affected Products

Languages:

Choose your region

Title

Title