Emerging Threatmediumtest

Potential CVE-2021-42278 Exploitation Attempt

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Wed Dec 15Updated Fri Apr 1444bbff3e-4ca3-452d-a49a-6efa4cafa06f2021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Windowssystem

ProductWindows← raw: windows

Servicesystem← raw: system

Detection Logic

detection:
    selection:
        Provider_Name: 'Microsoft-Windows-Kerberos-Key-Distribution-Center'  # Active Directory
        EventID:
            - 35 # PAC without attributes
            - 36 # Ticket without a PAC
            - 37 # Ticket without Requestor
            - 38 # Requestor Mismatch
    condition: selection