Detection rules › Sigma
Kerberos ticket without a trailing $ (CVE-2021-42278/42287)
Detects scenarios where an attacker attempts to spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1068 Exploitation for Privilege Escalation |
| Credential Access | T1558 Steal or Forge Kerberos Tickets |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4768 | A Kerberos authentication ticket (TGT) was requested. |
| Security-Auditing | Event ID 4769 | A Kerberos service ticket was requested. |
Rule body yaml
title: Kerberos ticket without a trailing $ (CVE-2021-42278/42287)
description: Detects scenarios where an attacker attempts to spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1558-Steal%20or%20Forge%20Kerberos%20Tickets
- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
- https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing
- https://support.microsoft.com/en-us/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041
- https://github.com/WazeHell/sam-the-admin
- https://github.com/cube0x0/noPac
- https://github.com/ly4k/Pachine
- https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
tags:
- attack.credential_access
- attack.t1558 # forged ticket
- attack.privilege_escalation
- attack.t1068 # exploitation for privilege escalation
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection_tgt:
EventID: 4768
Status: 0x0 # Success
ServiceSid|endswith: '-502' # Krbtgt account SID
#TargetUserName.lower() == Computer.split(".")[0].lower() # normal behavior would be that TargetUsername and Computer are different (DC01$ and DC01.domain.lan). Having both matching is suspicious.
selection_tgs:
EventID: 4769
Status: 0x0 # Success
ServiceName|endswith: $
#TargetUserName.split("@")[0].lower() == Computer.split(".")[0].lower() # normal behavior would be that TargetUsername and Computer are different (DC01$@domain.lan vs DC01.domain.lan). Having both matching is suspicious.
selection_host:
TargetUserName|contains: "$"
condition: (selection_tgt or selection_tgs) and not selection_host
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
(selection_tgt or selection_tgs) and not selection_hostStage 1: selection_tgt
selection_tgt:
EventID: 4768
Status: 0x0
ServiceSid|endswith: '-502'
Stage 2: selection_tgs
selection_tgs:
EventID: 4769
Status: 0x0
ServiceName|endswith: $
Stage 3: not selection_host
selection_host:
TargetUserName|contains: "$"
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
TargetUserName | match | $ |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ServiceName | ends_with |
|
ServiceSid | ends_with |
|
Status | eq |
|