Detection rules › Sigma
Computer account renamed without a trailing $ (CVE-2021-42278/42287)
Detects scenarios where an attacker attempts to spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller. Once the attack is done, attacker will rollback the sAMAccountName to its original name.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098 Account Manipulation |
| Privilege Escalation | T1068 Exploitation for Privilege Escalation, T1098 Account Manipulation |
| Stealth | T1036 Masquerading |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4781 | The name of an account was changed. |
Rule body yaml
title: Computer account renamed without a trailing $ (CVE-2021-42278/42287)
description: Detects scenarios where an attacker attempts to spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller. Once the attack is done, attacker will rollback the sAMAccountName to its original name.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
- https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing
- https://support.microsoft.com/en-us/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041
- https://github.com/WazeHell/sam-the-admin
- https://github.com/cube0x0/noPac
- https://github.com/ly4k/Pachine
- https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
- https://medium.com/@mvelazco/hunting-for-samaccountname-spoofing-cve-2021-42287-and-domain-controller-impersonation-f704513c8a45
tags:
- attack.persistence
- attack.t1098 # account manipulation
- attack.defense_evasion
- attack.t1036 # masquerading
- attack.privilege_escalation
- attack.t1068 # exploitation for privilege escalation
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection_baseline:
EventID: 4781 # account renamed
selection_change:
OldTargetUserName|endswith: $
filter_change:
NewTargetUserName|endswith: $ # new name looks a user account (no '$' at the end)
selection_rollback:
NewTargetUserName|endswith: $
filter_rollback:
OldTargetUserName|endswith: $
condition: selection_baseline and ((selection_change and not filter_change) or (selection_rollback and not filter_rollback))
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selection_baseline and ((selection_change and not filter_change) or (selection_rollback and not filter_rollback))Stage 1: selection_baseline
selection_baseline:
EventID: 4781
Stage 2: selection_change
selection_change:
OldTargetUserName|endswith: $
Stage 3: not filter_change
filter_change:
NewTargetUserName|endswith: $
Stage 4: selection_rollback
selection_rollback:
NewTargetUserName|endswith: $
Stage 5: not filter_rollback
filter_rollback:
OldTargetUserName|endswith: $
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
NewTargetUserName | ends_with | $ |
OldTargetUserName | ends_with | $ |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
NewTargetUserName | ends_with |
|
OldTargetUserName | ends_with |
|