McAfee coverage for July 2021 CVE-2021-36934 "HiveNightmare/SeriousSAM" vulnerability

Technical Articles ID: KB94710
Last Modified: 7/23/2021

Environment

McAfee Endpoint Security (ENS) Threat Prevention 10.x

Summary

Recent updates to this article

Date	Update
July 23, 2021	Updated the Expert Rule to reduce false positives.
July 22, 2021	Initial publication.

McAfee is aware of the "HiveNightmare/SeriousSAM" vulnerability, CVE-2021-36934, and is investigating product countermeasures. This article will be updated as we learn more.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Workaround

To block the vulnerability from being exploited, you can implement the following ENS user-defined Expert Rule.

Rule Name	Block CVE-2021-36934: 'HiveNightmare/SeriousSam'
Severity	High
Action	Block Report
Rule type	Files
Rule content	Rule { Process { Include AggregateMatch -xtype "ex1" { Exclude VTP_PRIVILEGES -type BITMASK { -v 0x8 } } Include AggregateMatch -xtype "ex2" { Exclude GROUP_SID { -v "S-1-16-16384" } Exclude GROUP_SID { -v "S-1-16-12288" } } Include AggregateMatch -xtype "ex3" { Exclude OBJECT_NAME { -v "vssadmin.exe" } } } Target { Match FILE { Include OBJECT_NAME { -v "\\windows\\system32\\config\\SAM" } Include OBJECT_NAME { -v "\\windows\\system32\\config\\SYSTEM" } Include OBJECT_NAME { -v "\\windows\\system32\\config\\SOFTWARE" } Include OBJECT_NAME { -v "\\windows\\system32\\config\\SECURITY" } Include -access "READ" } } }

Workaround

Microsoft's Security Response Center recommends restricting access to the contents of %windir%\system32\config\ and deleting any Volume Shadow Copy Service (VSS) shadow copies that were created before restricting access. For more information, see: Microsoft update guide on CVE-2021-36934.

Related Information

Microsoft Security Response Center: Microsoft update guide on CVE-2021-36934
Mitre CVE: CVE-2021-36934

Affected Products

Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Vulnerability Response

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

McAfee coverage for July 2021 CVE-2021-36934 "HiveNightmare/SeriousSAM" vulnerability

Environment

Summary

Workaround

Workaround

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

McAfee coverage for July 2021 CVE-2021-36934 "HiveNightmare/SeriousSAM" vulnerability

Environment

Summary

Workaround

Workaround

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title