MalwareExploits 2 CVEs

PetitPotam

PetitPotam is a proof-of-concept tool/technique released in July 2021 that coerces Windows systems to authenticate to arbitrary or attacker-controlled endpoints by abusing Microsoft’s Encrypting File System Remote Protocol (EFSRPC), including EfsRpcOpenFileRaw and related methods. The content associates PetitPotam with CVE-2021-36942 and describes it as a classic NTLM relay attack technique that can be used against Windows domain controllers and other Windows servers. It is particularly dangerous in environments using Active Directory Certificate Services (AD CS) where NTLM relay protections are not enabled. Multiple sources in the content state that, when combined with AD CS NTLM relay attack paths documented by SpecterOps, PetitPotam can allow an unauthenticated attacker to escalate privileges to full domain administrator under the right conditions. The content references Microsoft, CISA, and Splunk coverage of PetitPotam, as well as detection content for suspicious Kerberos TGT requests related to PetitPotam. Targeted systems are Windows hosts, especially AD CS servers, domain controllers, and other Windows servers that permit NTLM authentication without protections such as Extended Protection for Authentication (EPA) and HTTPS/Require SSL on relevant AD CS web services.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2026-24294Windows SMB Server Elevation of Privilege Vulnerability

This vulnerability was assigned CVE-2026-24294 and was patched in March 2026 Patch Tuesday. It works by default on Windows Server 2025 but not on Windows 11 24H2 because SMB signing is enforced.

via synacktiv blogsynacktiv.com

CVE-2021-36942PetitPotam / Windows LSA Spoofing Vulnerability

In July 2021, a security researcher released PetitPotam, a tool that allows attackers to coerce Windows systems into authenticating to arbitrary endpoints.

via splunk researchresearch.splunk.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

The flaw allows an attacker to gain administrative privileges of an Active Directory Certificate Server once on the network with another exploit or malware infecting a system.

Persistence

1 technique

T1078Valid AccountsEvidence1

The flaw allows an attacker to gain administrative privileges of an Active Directory Certificate Server once on the network with another exploit or malware infecting a system.

Privilege Escalation

3 techniques

T1068Exploitation for Privilege EscalationEvidence2

Security researchers, including Unit 42, have documented the use of coercion tools such as PetitPotam (CVE-2021-36942) in actual attacks.

T1078Valid AccountsEvidence1

The flaw allows an attacker to gain administrative privileges of an Active Directory Certificate Server once on the network with another exploit or malware infecting a system.

T1548Abuse Elevation Control MechanismEvidence1

PetitPotam (CVE-2021-36942,) is a vulnerablity identified in Microsofts EFSRPC Protocol that can allow an unauthenticated account to escalate privileges to domain administrator given the right circumstances.

Stealth

1 technique

T1078Valid AccountsEvidence1

The flaw allows an attacker to gain administrative privileges of an Active Directory Certificate Server once on the network with another exploit or malware infecting a system.

Credential Access

4 techniques

T1003OS Credential DumpingEvidence1

PetitPotam Suspicious Kerberos TGT Request ... OS Credential Dumping

T1187Forced AuthenticationEvidence16

PetitPotam est utilisé pour forcer le compte machine du serveur WSUS ( WSUS1$ ) à s’authentifier vers la machine de l’attaquant via MS-EFSRPC.

T1557Adversary-in-the-MiddleEvidence3

Poisoning / Coercion Responder LLMNR/NBT-NS mitm6 IPv6/WPAD ntlmrelayx SMB relay LDAP/LDAPS relay PetitPotam PrinterBug DFSCoerce ADCS ESC8 HTTP→LDAP

T1557.001LLMNR/NBT-NS Poisoning and SMB RelayEvidence5

During the week of July 19th, 2021, information security researchers published a proof of concept tool named “PetitPotam” that exploits a flaw in Microsoft Windows Active Directory Certificate Servers with an NTLM relay attack.

Collection

2 techniques

T1557Adversary-in-the-MiddleEvidence3

Poisoning / Coercion Responder LLMNR/NBT-NS mitm6 IPv6/WPAD ntlmrelayx SMB relay LDAP/LDAPS relay PetitPotam PrinterBug DFSCoerce ADCS ESC8 HTTP→LDAP

T1557.001LLMNR/NBT-NS Poisoning and SMB RelayEvidence5

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app10 months ago

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

cyber security newsNews

Jan 6, 2026

Active Directory Attack Kill Chain Checklist & Tools List- 2026

PetitPotam is an exploit that abuses MS-EFSRPC to coerce Windows hosts to authenticate to other machines, enabling NTLM relay attacks that can lead to domain compromise.

splunk researchNews

Feb 2, 2022

Analytics Story: Active Directory Kerberos Attacks | Splunk Security Content

PetitPotam is referenced in the context of suspicious Kerberos TGT requests and credential-access-related activity.

ncc group researchNews

Jan 10, 2022

NCC Group’s 2021 Annual Research Report

PetitPotam is a proof-of-concept exploit tool that abuses a flaw in Windows Active Directory Certificate Services to relay NTLM authentication and gain administrative privileges.

splunk researchNews

Aug 31, 2021

Analytics Story: PetitPotam NTLM Relay on Active Directory Certificate Services | Splunk Security Content

A tool exploiting the Microsoft EFSRPC protocol issue (CVE-2021-36942) to coerce Windows systems into authenticating to arbitrary endpoints, enabling NTLM relay and potential privilege escalation to domain administrator in certain AD CS attack chains.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

PetitPotam