Suspicious Computer or User Account Name 'SAMTHEADMIN-X$'

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•32

Detects the creation or modification of a computer account or user account with a suspicious name pattern 'SAMTHEADMIN-X$' (where X is a number) which is known to be generated by a hacktool exploiting CVE-2021-42287 and CVE-2021-42278. This pattern is associated with the 'Sam the Admin' vulnerability exploitation.