CVE2021

CVE-2021-42287

2Rules

2References

1Folders

2023-04-14Latest

Summary

CVE-2021-42287 is tracked here through 2 Sigma detections for exploitation attempts and related post-exploitation behavior observed in 2021. Coverage centers on windows / security, windows / system.

Related Detections

Search this threat

mediumtestEmerging Threat

Potential CVE-2021-42287 Exploitation Attempt

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

windowssystem

2023-04-14

hightestEmerging Threat

Suspicious Computer Account Name Change CVE-2021-42287

Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

windowssecurity

2022-12-25

References