From 3bb97122862f35cf814b5a1c01488fa18946cc3f Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Wed, 15 Dec 2021 15:53:06 -0500
Subject: [PATCH 01/12] updating detection to use data models

---
 ...nnection_from_java_using_default_ports.yml | 35 ++++++++++++-------
 ...ion_from_java_using_default_ports.test.yml |  8 ++---
 2 files changed, 26 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
index 422529e4f5..b6a7d9bd8f 100644
--- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
+++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
@@ -12,10 +12,17 @@ description: A required step while exploiting the CVE-2021-44228-Log4j vulnerabi
   reaching out to default ports used by the LDAP and RMI protocols. This behavior
   could represent successfull exploitation. Note that adversaries can easily decide
   to use arbitrary ports for these protocols and potentially bypass this detection.
-search: ' `sysmon` EventCode=3  (process_name=java OR process_name=java.exe) (DestinationPort=389
-  OR DestinationPort=1389 OR DestinationPort = 1099 ) | rename Computer as dest |  stats
-  count min(_time) as firstTime max(_time) as lastTime by dest, process_name, DestinationPort
-  | `security_content_ctime(firstTime)` | `outbound_network_connection_from_java_using_default_ports_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe)  
+  by _time Processes.process_guid Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+|  `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)` 
+| join  process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
+  where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)`
+|  rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port
+| `outbound_network_connection_from_java_using_default_ports_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -35,12 +42,11 @@ tags:
   cve:
   - CVE-2021-44228
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: Java performed outbound connections to default ports of LDAP or RMI on
-    $dest$
+  message: Java performed outbound connections to default ports of LDAP or RMI on $dest$
   mitre_attack_id:
   - T1190
   observable:
@@ -54,11 +60,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - EventID
-  - CommandLine
-  - Computer
-  - DestinationPort
-  - DestinationIp
+  - Processes.process_guid
+  - Processes.process_name
+  - Processes.dest
+  - Processes.process_path
+  - Processes.process
+  - Processes.parent_process_name
+  - Ports.process_guid
+  - Ports.dest 
+  - Ports.dest_port
   risk_score: 54
   security_domain: endpoint
diff --git a/tests/endpoint/outbound_network_connection_from_java_using_default_ports.test.yml b/tests/endpoint/outbound_network_connection_from_java_using_default_ports.test.yml
index 09e3797d54..2f972aaf90 100644
--- a/tests/endpoint/outbound_network_connection_from_java_using_default_ports.test.yml
+++ b/tests/endpoint/outbound_network_connection_from_java_using_default_ports.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: linux-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log
-    source: Syslog:Linux-Sysmon/Operational
-    sourcetype: sysmon_linux
\ No newline at end of file
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 496f97a0eef83cf0d0657e1140d0ef914181d54b Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-39-58>
Date: Wed, 15 Dec 2021 21:19:25 +0000
Subject: [PATCH 02/12] Added detection testing service results inOutbound
 Network Connection from Java Using Default Ports

---
 ...nnection_from_java_using_default_ports.yml | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
index b6a7d9bd8f..b22c450fe7 100644
--- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
+++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
@@ -13,16 +13,15 @@ description: A required step while exploiting the CVE-2021-44228-Log4j vulnerabi
   could represent successfull exploitation. Note that adversaries can easily decide
   to use arbitrary ports for these protocols and potentially bypass this detection.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe)  
-  by _time Processes.process_guid Processes.process_name
+  where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR
+  Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
-|  `drop_dm_object_name(Processes)` 
-| `security_content_ctime(firstTime)`
-| `security_content_ctime(lastTime)` 
-| join  process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
-  where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)`
-|  rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port
-| `outbound_network_connection_from_java_using_default_ports_filter`'
+  |  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | join  process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
+  where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR
+  Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)`
+  |  rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
+  process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -46,7 +45,8 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: Java performed outbound connections to default ports of LDAP or RMI on $dest$
+  message: Java performed outbound connections to default ports of LDAP or RMI on
+    $dest$
   mitre_attack_id:
   - T1190
   observable:
@@ -67,7 +67,7 @@ tags:
   - Processes.process
   - Processes.parent_process_name
   - Ports.process_guid
-  - Ports.dest 
+  - Ports.dest
   - Ports.dest_port
   risk_score: 54
   security_domain: endpoint

From 82a4a63093f52310162a1661056f981f1e6e866e Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 20 Dec 2021 16:58:34 -0500
Subject: [PATCH 03/12] creating analytic story and first detection

---
 ...uspicious_computer_account_name_change.yml | 57 +++++++++++++++++++
 ...mpersonation_&_samaccountname_spoofing.yml | 29 ++++++++++
 ...ious_computer_account_name_change.test.yml | 13 +++++
 3 files changed, 99 insertions(+)
 create mode 100644 detections/endpoint/suspicious_computer_account_name_change.yml
 create mode 100644 stories/domain_controller_impersonation_&_samaccountname_spoofing.yml
 create mode 100644 tests/endpoint/suspicious_computer_account_name_change.test.yml

diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml
new file mode 100644
index 0000000000..249cfd035e
--- /dev/null
+++ b/detections/endpoint/suspicious_computer_account_name_change.yml
@@ -0,0 +1,57 @@
+name: Suspicious Computer Account Name Change
+id: 35a61ed8-61c4-11ec-bc1e-acde48001122
+version: 1
+date: '2021-12-20'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287)
+  exploitation chain, adversaries need to create a new computer account name and rename it to 
+  match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer 
+  account names always end with `$`. This analytic leverages Event Id 4781, 
+  `The name of an account was changed`, to identify a computer account rename event with a suspicious name.
+  This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
+search: '`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$"
+  | table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name
+  | `suspicious_computer_account_name_change_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
+known_false_positives: Renaming a computer account name to a name that not end with '$' is highly unsual
+  and may not have any legitimate scenarios.
+references:
+- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
+tags:
+  analytic_story:
+  - sAMAccountName Spoofing and Domain Controller Impersonation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaaccountname_spoofing/windows-security.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1078
+  - T1078.002
+  cve:
+  - CVE-2021-42287
+  - CVE-2021-42278
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ComputerName
+  - Account_Name
+  - Old_Account_Name
+  - New_Account_Name
+  security_domain: endpoint
+  impact: 100
+  confidence: 70 
+  risk_score: 70
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: 
+  observable:
\ No newline at end of file
diff --git a/stories/domain_controller_impersonation_&_samaccountname_spoofing.yml b/stories/domain_controller_impersonation_&_samaccountname_spoofing.yml
new file mode 100644
index 0000000000..9d385372ba
--- /dev/null
+++ b/stories/domain_controller_impersonation_&_samaccountname_spoofing.yml
@@ -0,0 +1,29 @@
+name: sAMAccountName Spoofing and Domain Controller Impersonation
+id: 0244fdee-61be-11ec-900e-acde48001122
+version: 1
+date: '2021-12-20'
+author: Mauricio Velazco, Splunk
+description: Monitor for activities and techniques associated with the exploitation of the sAMAccountName Spoofing (CVE-2021-42278) 
+  and Domain Controller Impersonation (CVE-2021-42287) vulnerabilities.
+narrative: On November 9, 2021, Microsoft released patches to address two vulnerabilities that affect Windows Active Directory networks, 
+  sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287). On December 10, 2021, security researchers Charlie Clark and
+  Andrew Schwartz released a blog post where they shared how to weaponise these vulnerabilities in a target network an the initial detection opportunities. When successfully exploited, 
+  CVE-2021-42278 and CVE-2021-42287 allow an adversary, who has stolen the credentials of a low priviled domain user, to obtain a Kerberos Service ticket for a 
+  Domain Controller computer account. The only requirement is to have network connectivity to a domain controller. 
+  This attack vector effectivelly allows attackers to escalate their privileges in an Active Directory from a regular domain user account 
+  and take control of a domain controller. While patches have been released to address these vulnerabilities, deploying detection controls for this attack may help
+  help defenders identify attackers attempting exploitation. 
+references:
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
+- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
+tags:
+  analytic_story:
+  - sAMAccountName Spoofing and Domain Controller Impersonation
+  category:
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_computer_account_name_change.test.yml b/tests/endpoint/suspicious_computer_account_name_change.test.yml
new file mode 100644
index 0000000000..bbbac915ab
--- /dev/null
+++ b/tests/endpoint/suspicious_computer_account_name_change.test.yml
@@ -0,0 +1,13 @@
+name: Suspicious Computer Account Name Change Unit Test
+tests:
+- name: Suspicious Computer Account Name Change
+  file: endpoint/suspicious_computer_account_name_change.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/sAMAccountName_spoofing/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
\ No newline at end of file

From 243e60a3cc575eac72dac961245b0206b92ae65b Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 20 Dec 2021 17:04:58 -0500
Subject: [PATCH 04/12] minor fix

---
 detections/endpoint/suspicious_computer_account_name_change.yml | 2 +-
 tests/endpoint/suspicious_computer_account_name_change.test.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml
index 249cfd035e..d65729ed77 100644
--- a/detections/endpoint/suspicious_computer_account_name_change.yml
+++ b/detections/endpoint/suspicious_computer_account_name_change.yml
@@ -27,7 +27,7 @@ tags:
   analytic_story:
   - sAMAccountName Spoofing and Domain Controller Impersonation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaaccountname_spoofing/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
diff --git a/tests/endpoint/suspicious_computer_account_name_change.test.yml b/tests/endpoint/suspicious_computer_account_name_change.test.yml
index bbbac915ab..18f8ebe21b 100644
--- a/tests/endpoint/suspicious_computer_account_name_change.test.yml
+++ b/tests/endpoint/suspicious_computer_account_name_change.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/sAMAccountName_spoofing/windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
     update_timestamp: True
\ No newline at end of file

From af31bdb3ecdcd13e8106a7c7d3e88a6d24f56bf4 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 20 Dec 2021 17:20:58 -0500
Subject: [PATCH 05/12] updating observable

---
 .../endpoint/suspicious_computer_account_name_change.yml  | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml
index d65729ed77..0c57c7cbaa 100644
--- a/detections/endpoint/suspicious_computer_account_name_change.yml
+++ b/detections/endpoint/suspicious_computer_account_name_change.yml
@@ -53,5 +53,9 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Privilege Escalation
-  message: 
-  observable:
\ No newline at end of file
+  message: A computer account $Old_Account_Name$ was renamed with a suspicious computer name
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file

From 653a7755e8b4b10e652a407052276eec8a005a0d Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-143-73>
Date: Mon, 20 Dec 2021 22:50:20 +0000
Subject: [PATCH 06/12] Added detection testing service results inSuspicious
 Computer Account Name Change

---
 ...uspicious_computer_account_name_change.yml | 32 +++++++++++--------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml
index 0c57c7cbaa..b534e261de 100644
--- a/detections/endpoint/suspicious_computer_account_name_change.yml
+++ b/detections/endpoint/suspicious_computer_account_name_change.yml
@@ -6,22 +6,24 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287)
-  exploitation chain, adversaries need to create a new computer account name and rename it to 
-  match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer 
-  account names always end with `$`. This analytic leverages Event Id 4781, 
-  `The name of an account was changed`, to identify a computer account rename event with a suspicious name.
-  This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
+description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
+  Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a
+  new computer account name and rename it to match the name of a domain controller
+  account without the ending '$'. In Windows Active Directory environments, computer
+  account names always end with `$`. This analytic leverages Event Id 4781, `The name
+  of an account was changed`, to identify a computer account rename event with a suspicious
+  name. This behavior could represent an exploitation attempt of CVE-2021-42278 and
+  CVE-2021-42287 for privilege escalation.
 search: '`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$"
-  | table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name
-  | `suspicious_computer_account_name_change_filter`'
+  | table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name |
+  `suspicious_computer_account_name_change_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
-known_false_positives: Renaming a computer account name to a name that not end with '$' is highly unsual
-  and may not have any legitimate scenarios.
+known_false_positives: Renaming a computer account name to a name that not end with
+  '$' is highly unsual and may not have any legitimate scenarios.
 references:
 - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
 tags:
   analytic_story:
@@ -48,14 +50,16 @@ tags:
   - New_Account_Name
   security_domain: endpoint
   impact: 100
-  confidence: 70 
+  confidence: 70
   risk_score: 70
   context:
   - Source:Endpoint
   - Stage:Privilege Escalation
-  message: A computer account $Old_Account_Name$ was renamed with a suspicious computer name
+  message: A computer account $Old_Account_Name$ was renamed with a suspicious computer
+    name
   observable:
   - name: ComputerName
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 6fa0f9b30bcece825575bcb4f2c9c19071edca38 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 20 Dec 2021 22:08:19 -0500
Subject: [PATCH 07/12] adding new detection

---
 ...uspicious_computer_account_name_change.yml |  3 +-
 ...icious_kerberos_service_ticket_request.yml | 64 +++++++++++++++++++
 ...s_kerberos_service_ticket_request.test.yml | 13 ++++
 3 files changed, 79 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/suspicious_kerberos_service_ticket_request.yml
 create mode 100644 tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml

diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml
index 0c57c7cbaa..600847c35b 100644
--- a/detections/endpoint/suspicious_computer_account_name_change.yml
+++ b/detections/endpoint/suspicious_computer_account_name_change.yml
@@ -10,7 +10,7 @@ description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
   exploitation chain, adversaries need to create a new computer account name and rename it to 
   match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer 
   account names always end with `$`. This analytic leverages Event Id 4781, 
-  `The name of an account was changed`, to identify a computer account rename event with a suspicious name.
+  `The name of an account was changed`, to identify a computer account rename event with a suspicious name that does not terminate with `$`.
   This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
 search: '`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$"
   | table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name
@@ -42,6 +42,7 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode
   - ComputerName
   - Account_Name
   - Old_Account_Name
diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
new file mode 100644
index 0000000000..3aef99a75f
--- /dev/null
+++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
@@ -0,0 +1,64 @@
+name: Suspicious Kerberos Service Ticket Request
+id: 8b1297bc-6204-11ec-b7c4-acde48001122
+version: 1
+date: '2021-12-20'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287)
+  exploitation chain, adversaries will request and obtain a Kerberos Service Ticket (TGS) with a domain controller computer account as the Service Name. 
+  This Service Ticket can be then used to take control of the domain controller on the final part of the attack. This analytic leverages Event Id 4769, 
+  `A Kerberos service ticket was requested`, to identify an unusual TGS request where the Account_Name requesting the ticket matches the Service_Name field. 
+  This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
+search: ' `wineventlog_security` EventCode=4769
+| eval isSuspicious = if(lower(Service_Name) = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0)
+| table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious
+| `suspicious_kerberos_service_ticket_request_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, 
+  they may be possible in certain environments. Filter as needed.
+references:
+- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
+- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13
+tags:
+  analytic_story:
+  - sAMAccountName Spoofing and Domain Controller Impersonation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1078
+  - T1078.002
+  cve:
+  - CVE-2021-42287
+  - CVE-2021-42278
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Service_Name
+  - Account_Name
+  - Client_Address
+  - Failure_Code
+  security_domain: endpoint
+  impact: 100
+  confidence: 60 
+  risk_score: 60
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: A suspicious Kerberos Service Ticket was requested by $Account_Name$
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml b/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml
new file mode 100644
index 0000000000..b101e3b2ce
--- /dev/null
+++ b/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml
@@ -0,0 +1,13 @@
+name: Suspicious Kerberos Service Ticket Request Unit Test
+tests:
+- name: Suspicious Kerberos Service Ticket Request
+  file: endpoint/suspicious_kerberos_service_ticket_request.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
\ No newline at end of file

From 122d403d6c6001e00e9449243322e1bb0191c152 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-35-211>
Date: Tue, 21 Dec 2021 03:34:17 +0000
Subject: [PATCH 08/12] Added detection testing service results inSuspicious
 Kerberos Service Ticket Request

---
 ...icious_kerberos_service_ticket_request.yml | 33 +++++++++++--------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
index 3aef99a75f..d8c081d71d 100644
--- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
+++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
@@ -6,23 +6,27 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287)
-  exploitation chain, adversaries will request and obtain a Kerberos Service Ticket (TGS) with a domain controller computer account as the Service Name. 
-  This Service Ticket can be then used to take control of the domain controller on the final part of the attack. This analytic leverages Event Id 4769, 
-  `A Kerberos service ticket was requested`, to identify an unusual TGS request where the Account_Name requesting the ticket matches the Service_Name field. 
-  This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
-search: ' `wineventlog_security` EventCode=4769
-| eval isSuspicious = if(lower(Service_Name) = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0)
-| table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious
-| `suspicious_kerberos_service_ticket_request_filter`'
+description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
+  Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and
+  obtain a Kerberos Service Ticket (TGS) with a domain controller computer account
+  as the Service Name. This Service Ticket can be then used to take control of the
+  domain controller on the final part of the attack. This analytic leverages Event
+  Id 4769, `A Kerberos service ticket was requested`, to identify an unusual TGS request
+  where the Account_Name requesting the ticket matches the Service_Name field. This
+  behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287
+  for privilege escalation.
+search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name)
+  = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | table _time, Client_Address,
+  Account_Name, Service_Name, Failure_Code, isSuspicious | `suspicious_kerberos_service_ticket_request_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
   `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
-known_false_positives: We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, 
-  they may be possible in certain environments. Filter as needed.
+known_false_positives: We have tested this detection logic with ~2 million 4769 events
+  and did not identify false positives. However, they may be possible in certain environments.
+  Filter as needed.
 references:
 - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
 - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13
 tags:
@@ -51,7 +55,7 @@ tags:
   - Failure_Code
   security_domain: endpoint
   impact: 100
-  confidence: 60 
+  confidence: 60
   risk_score: 60
   context:
   - Source:Endpoint
@@ -61,4 +65,5 @@ tags:
   - name: ComputerName
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 4631c84a60270d858e78144799301ee77701fc7a Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 20 Dec 2021 22:38:27 -0500
Subject: [PATCH 09/12] updating logic

---
 .../suspicious_kerberos_service_ticket_request.yml         | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
index d8c081d71d..f2aad7d18a 100644
--- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
+++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
@@ -15,9 +15,10 @@ description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
   where the Account_Name requesting the ticket matches the Service_Name field. This
   behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287
   for privilege escalation.
-search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name)
-  = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | table _time, Client_Address,
-  Account_Name, Service_Name, Failure_Code, isSuspicious | `suspicious_kerberos_service_ticket_request_filter`'
+search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name) = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) 
+  | where isSuspicious = 1
+  | table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious 
+  | `suspicious_kerberos_service_ticket_request_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
   `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.

From da634d5c2573dd221741df7682ca8428c02c82d4 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-122-186>
Date: Tue, 21 Dec 2021 03:57:17 +0000
Subject: [PATCH 10/12] Added detection testing service results inSuspicious
 Kerberos Service Ticket Request

---
 .../endpoint/suspicious_kerberos_service_ticket_request.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
index f2aad7d18a..01088d134a 100644
--- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
+++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
@@ -15,9 +15,9 @@ description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
   where the Account_Name requesting the ticket matches the Service_Name field. This
   behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287
   for privilege escalation.
-search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name) = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) 
-  | where isSuspicious = 1
-  | table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious 
+search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name)
+  = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 |
+  table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious
   | `suspicious_kerberos_service_ticket_request_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting

From bb8ae58f84993a4766f1d481cffc3889f37f8bf4 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 21 Dec 2021 13:44:17 -0500
Subject: [PATCH 11/12] adding new detection

---
 ...picious_ticket_granting_ticket_request.yml | 65 +++++++++++++++++++
 ...us_ticket_granting_ticket_request.test.yml | 13 ++++
 2 files changed, 78 insertions(+)
 create mode 100644 detections/endpoint/suspicious_ticket_granting_ticket_request.yml
 create mode 100644 tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml

diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
new file mode 100644
index 0000000000..935f701768
--- /dev/null
+++ b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
@@ -0,0 +1,65 @@
+name: Suspicious Ticket Granting Ticket Request
+id: d77d349e-6269-11ec-9cfe-acde48001122
+version: 1
+date: '2021-12-21'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
+  Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request a
+  Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed computer account. 
+  The TGT request will be preceded by a computer account name event. This analytic leverages Event Id 4781, 
+  `The name of an account was changed` and event Id 4768 `A Kerberos authentication ticket (TGT) was requested` 
+  to correlate a sequence of events where the new computer account on event id 4781 matches the request account on event id 4768.
+  This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
+search: ' `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$") OR (EventCode=4768 Account_Name!="*$")
+  | eval RenamedComputerAccount = coalesce(New_Account_Name, mvindex(Account_Name,0)) 
+  | transaction RenamedComputerAccount startswith=(EventCode=4781) endswith=(EventCode=4768)
+  | eval short_lived=case((duration<2),"TRUE") 
+  | search short_lived = TRUE 
+  | table _time, ComputerName, EventCode, Account_Name,RenamedComputerAccount, short_lived
+  |`suspicious_ticket_granting_ticket_request_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: A computer account name change event inmediately followed by a kerberos TGT
+  request with matching fields is unsual. However, legitimate behavior may trigger it. Filter as needed.
+references:
+- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
+tags:
+  analytic_story:
+  - sAMAccountName Spoofing and Domain Controller Impersonation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1078
+  - T1078.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Old_Account_Name
+  - New_Account_Name
+  - Account_Name
+  - ComputerName
+  security_domain: endpoint
+  impact: 100
+  confidence: 60
+  risk_score: 60
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: A suspicious TGT was requested was requested
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml b/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml
new file mode 100644
index 0000000000..b1c22e97be
--- /dev/null
+++ b/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml
@@ -0,0 +1,13 @@
+name: Suspicious Ticket Granting Ticket Request Unit Test
+tests:
+- name: Suspicious Ticket Granting Ticket Request
+  file: endpoint/suspicious_ticket_granting_ticket_request.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
\ No newline at end of file

From 9243038c09c2b42aafd848a0784ba3a8bdadd120 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-106-108>
Date: Tue, 21 Dec 2021 19:06:04 +0000
Subject: [PATCH 12/12] Added detection testing service results inSuspicious
 Ticket Granting Ticket Request

---
 ...picious_ticket_granting_ticket_request.yml | 35 ++++++++++---------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
index 935f701768..769e3f4a24 100644
--- a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
+++ b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
@@ -7,24 +7,26 @@ type: Hunting
 datamodel:
 - Endpoint
 description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
-  Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request a
-  Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed computer account. 
-  The TGT request will be preceded by a computer account name event. This analytic leverages Event Id 4781, 
-  `The name of an account was changed` and event Id 4768 `A Kerberos authentication ticket (TGT) was requested` 
-  to correlate a sequence of events where the new computer account on event id 4781 matches the request account on event id 4768.
-  This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
-search: ' `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$") OR (EventCode=4768 Account_Name!="*$")
-  | eval RenamedComputerAccount = coalesce(New_Account_Name, mvindex(Account_Name,0)) 
-  | transaction RenamedComputerAccount startswith=(EventCode=4781) endswith=(EventCode=4768)
-  | eval short_lived=case((duration<2),"TRUE") 
-  | search short_lived = TRUE 
-  | table _time, ComputerName, EventCode, Account_Name,RenamedComputerAccount, short_lived
-  |`suspicious_ticket_granting_ticket_request_filter`'
+  Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request
+  a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed
+  computer account. The TGT request will be preceded by a computer account name event.
+  This analytic leverages Event Id 4781, `The name of an account was changed` and
+  event Id 4768 `A Kerberos authentication ticket (TGT) was requested` to correlate
+  a sequence of events where the new computer account on event id 4781 matches the
+  request account on event id 4768. This behavior could represent an exploitation
+  attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
+search: ' `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$")
+  OR (EventCode=4768 Account_Name!="*$") | eval RenamedComputerAccount = coalesce(New_Account_Name,
+  mvindex(Account_Name,0)) | transaction RenamedComputerAccount startswith=(EventCode=4781)
+  endswith=(EventCode=4768) | eval short_lived=case((duration<2),"TRUE") | search
+  short_lived = TRUE | table _time, ComputerName, EventCode, Account_Name,RenamedComputerAccount,
+  short_lived |`suspicious_ticket_granting_ticket_request_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
   `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
-known_false_positives: A computer account name change event inmediately followed by a kerberos TGT
-  request with matching fields is unsual. However, legitimate behavior may trigger it. Filter as needed.
+known_false_positives: A computer account name change event inmediately followed by
+  a kerberos TGT request with matching fields is unsual. However, legitimate behavior
+  may trigger it. Filter as needed.
 references:
 - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
@@ -62,4 +64,5 @@ tags:
   - name: ComputerName
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed