Suspicious Computer Account Name Change (CVE-2021-42287)

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•42

Detects the renaming of an existing computer account to an account name that doesn't contain a '$' symbol, which is a key indicator of the CVE-2021-42287 (SamAccountName Spoofing) attack. This technique is often used to impersonate a Domain Controller.