From 653a7755e8b4b10e652a407052276eec8a005a0d Mon Sep 17 00:00:00 2001 From: root Date: Mon, 20 Dec 2021 22:50:20 +0000 Subject: [PATCH] Added detection testing service results inSuspicious Computer Account Name Change --- ...uspicious_computer_account_name_change.yml | 32 +++++++++++-------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml index 0c57c7cbaa..b534e261de 100644 --- a/detections/endpoint/suspicious_computer_account_name_change.yml +++ b/detections/endpoint/suspicious_computer_account_name_change.yml @@ -6,22 +6,24 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) - exploitation chain, adversaries need to create a new computer account name and rename it to - match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer - account names always end with `$`. This analytic leverages Event Id 4781, - `The name of an account was changed`, to identify a computer account rename event with a suspicious name. - This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. +description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller + Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a + new computer account name and rename it to match the name of a domain controller + account without the ending '$'. In Windows Active Directory environments, computer + account names always end with `$`. This analytic leverages Event Id 4781, `The name + of an account was changed`, to identify a computer account rename event with a suspicious + name. This behavior could represent an exploitation attempt of CVE-2021-42278 and + CVE-2021-42287 for privilege escalation. search: '`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$" - | table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name - | `suspicious_computer_account_name_change_filter`' + | table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name | + `suspicious_computer_account_name_change_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. -known_false_positives: Renaming a computer account name to a name that not end with '$' is highly unsual - and may not have any legitimate scenarios. +known_false_positives: Renaming a computer account name to a name that not end with + '$' is highly unsual and may not have any legitimate scenarios. references: - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287 tags: analytic_story: @@ -48,14 +50,16 @@ tags: - New_Account_Name security_domain: endpoint impact: 100 - confidence: 70 + confidence: 70 risk_score: 70 context: - Source:Endpoint - Stage:Privilege Escalation - message: A computer account $Old_Account_Name$ was renamed with a suspicious computer name + message: A computer account $Old_Account_Name$ was renamed with a suspicious computer + name observable: - name: ComputerName type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed