Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
3
Contributors
3
3
Categories
5
3
3
2
1
Platforms
6
Products / Services
5
3
3
MITRE Techniques
5
5
5
5
4
CVEs
71
71
64
58
49
Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool
Detects the creation or modification of a computer account or user account with a suspicious name pattern 'SAMTHEADMIN-X$' (where X is a number) which is known to be generated by a hacktool exploiting CVE-2021-42287 and CVE-2021-42278. This pattern is associated with the 'Sam the Admin' vulnerability exploitation.
This analytic detects suspicious Kerberos Service Ticket (TGS) requests where the requesting account name matches the service name. This behavior is indicative of an exploitation attempt of CVE-2021-42278 and CVE-2021-42287, often referred to as sAMAccountName spoofing. The detection leverages Windows Event ID 4769 from Domain Controllers. Such activity is significant as it may represent an adversary attempting to escalate privileges by impersonating a domain controller, which could lead to complete domain compromise and unauthorized access to sensitive information.
The analytic detects a suspicious computer account name change in Active Directory. It leverages Event ID 4781, which logs account name changes, to identify instances where a computer account name is changed to one that does not end with a '$'. This behavior is significant as it may indicate an attempt to exploit CVE-2021-42278 and CVE-2021-42287, which can lead to domain controller impersonation and privilege escalation. If confirmed malicious, this activity could allow an attacker to gain elevated privileges and potentially control the domain.
This analytic detects suspicious Kerberos Ticket Granting Ticket (TGT) requests that may indicate exploitation of CVE-2021-42278 and CVE-2021-42287. It identifies sequences where a computer account is renamed (Event ID 4781) and immediately followed by a TGT request (Event ID 4768) for that same account. This behavior is significant as it could represent an attempt to escalate privileges by impersonating a Domain Controller, potentially leading to elevated access and control over the domain environment.
This rule detects potential exploitation attempts of CVE-2021-42278, also known as "noPac" or "sAMAccountName spoofing". The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName (SPN) attribute. This manipulation grants the attacker additional permissions on the object, allowing them to make further changes. The detection logic specifically looks for Kerberos Key Distribution Center (KDC) events (EventIDs 35, 36, 37, 38) which indicate anomalies in PAC (Privilege Attribute Certificate) or ticket requests, consistent with the post-exploitation phase of CVE-2021-42278 where forged tickets are used.