adding new detection

detections/endpoint/suspicious_computer_account_name_change.yml

@@ -10,7 +10,7 @@ description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
   exploitation chain, adversaries need to create a new computer account name and rename it to 
   match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer 
   account names always end with `$`. This analytic leverages Event Id 4781, 
-  `The name of an account was changed`, to identify a computer account rename event with a suspicious name.
+  `The name of an account was changed`, to identify a computer account rename event with a suspicious name that does not terminate with `$`.
   This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
 search: '`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$"
   | table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name
@@ -42,6 +42,7 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode
   - ComputerName
   - Account_Name
   - Old_Account_Name

detections/endpoint/suspicious_kerberos_service_ticket_request.yml

@@ -0,0 +1,64 @@
+name: Suspicious Kerberos Service Ticket Request
+id: 8b1297bc-6204-11ec-b7c4-acde48001122
+version: 1
+date: '2021-12-20'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287)
+  exploitation chain, adversaries will request and obtain a Kerberos Service Ticket (TGS) with a domain controller computer account as the Service Name. 
+  This Service Ticket can be then used to take control of the domain controller on the final part of the attack. This analytic leverages Event Id 4769, 
+  `A Kerberos service ticket was requested`, to identify an unusual TGS request where the Account_Name requesting the ticket matches the Service_Name field. 
+  This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
+search: ' `wineventlog_security` EventCode=4769
+| eval isSuspicious = if(lower(Service_Name) = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0)
+| table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious
+| `suspicious_kerberos_service_ticket_request_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, 
+  they may be possible in certain environments. Filter as needed.
+references:
+- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
+- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13
+tags:
+  analytic_story:
+  - sAMAccountName Spoofing and Domain Controller Impersonation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1078
+  - T1078.002
+  cve:
+  - CVE-2021-42287
+  - CVE-2021-42278
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Service_Name
+  - Account_Name
+  - Client_Address
+  - Failure_Code
+  security_domain: endpoint
+  impact: 100
+  confidence: 60 
+  risk_score: 60
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: A suspicious Kerberos Service Ticket was requested by $Account_Name$
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim

tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml

@@ -0,0 +1,13 @@
+name: Suspicious Kerberos Service Ticket Request Unit Test
+tests:
+- name: Suspicious Kerberos Service Ticket Request
+  file: endpoint/suspicious_kerberos_service_ticket_request.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True