Potential CVE-2021-42287 Exploitation Attempt
This rule detects potential exploitation attempts of CVE-2021-42287, a vulnerability related to Active Directory's SAM Account Name Spoofing. The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName attribute. This manipulation grants the attacker additional permissions on the object, enabling further changes. The detection specifically looks for Event IDs 16990 (Object class and UserAccountControl validation failure) and 16991 (SAM Account Name validation failure) from the Microsoft-Windows-Directory-Services-SAM provider, which indicate issues during the creation or modification of Active Directory objects that are characteristic of this attack.
Sigma
