Detection rules › Sigma

Suspicious computer account created by a computer account

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker abuse MachineAccountQuota privilege and pre-create a computer object for abusing RBCD delegation.

Known false positives

  • Offline domain join host
  • Windows Autopilot Hybrid Azure AD Join

MITRE ATT&CK coverage

TacticTechniques
Persistence

Telemetry coverage

Rule body

title: Suspicious computer account created by a computer account
description: Detects scenarios where an attacker abuse MachineAccountQuota privilege and pre-create a computer object for abusing RBCD delegation.
references:
- https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/
tags:
- attack.persistence
- attack.t1136
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4741
    SubjectUserName|endswith: '$'
    SubjectUserSid|startswith: 'S-1-5-21-' # SYSTEM account 'S-1-5-18' would trigger a false positive
    TargetUserName|endswith: '$'
  condition: selection
falsepositives:
- Offline domain join host  
- Windows Autopilot Hybrid Azure AD Join
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 4741
  SubjectUserName|endswith: '$'
  SubjectUserSid|startswith: 'S-1-5-21-'
  TargetUserName|endswith: '$'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
SubjectUserNameends_with
  • $ corpus 5 (sigma 4, splunk 1)
field:"SubjectUserName" kind:ends_with value:"$"
SubjectUserSidstarts_with
  • S-1-5-21- corpus 5 (sigma 5)
field:"SubjectUserSid" kind:starts_with value:"S-1-5-21-"
TargetUserNameends_with
  • $ corpus 11 (sigma 7, splunk 2, kusto 2)
field:"TargetUserName" kind:ends_with value:"$"