admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inSuspicious Computer Account Name Change

Browse Source
This commit is contained in:
root
2021-12-20 22:50:20 +00:00
parent af31bdb3ec
commit 653a7755e8
1 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_computer_account_name_change.yml
+18 -14
View File
@@ -6,22 +6,24 @@ author: Mauricio Velazco, Splunk
type: TTP
datamodel:
- Endpoint
description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287)
exploitation chain, adversaries need to create a new computer account name and rename it to
match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer
account names always end with `$`. This analytic leverages Event Id 4781,
`The name of an account was changed`, to identify a computer account rename event with a suspicious name.
This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a
new computer account name and rename it to match the name of a domain controller
account without the ending '$'. In Windows Active Directory environments, computer
account names always end with `$`. This analytic leverages Event Id 4781, `The name
of an account was changed`, to identify a computer account rename event with a suspicious
name. This behavior could represent an exploitation attempt of CVE-2021-42278 and
CVE-2021-42287 for privilege escalation.
search: '`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$"
| table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name
| `suspicious_computer_account_name_change_filter`'
| table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name |
`suspicious_computer_account_name_change_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
known_false_positives: Renaming a computer account name to a name that not end with '$' is highly unsual
and may not have any legitimate scenarios.
known_false_positives: Renaming a computer account name to a name that not end with
'$' is highly unsual and may not have any legitimate scenarios.
references:
- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
tags:
analytic_story:
@@ -48,14 +50,16 @@ tags:
- New_Account_Name
security_domain: endpoint
impact: 100
confidence: 70
confidence: 70
risk_score: 70
context:
- Source:Endpoint
- Stage:Privilege Escalation
message: A computer account $Old_Account_Name$ was renamed with a suspicious computer name
message: A computer account $Old_Account_Name$ was renamed with a suspicious computer
name
observable:
- name: ComputerName
type: Endpoint
role:
- Victim
- Victim
automated_detection_testing: passed