Emerging Threatmediumtest

Potential CVE-2021-42287 Exploitation Attempt

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Wed Dec 15Updated Fri Apr 14e80a0fee-1a62-4419-b31e-0d0db6e6013a2021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Windowssystem

ProductWindows← raw: windows

Servicesystem← raw: system

Detection Logic

detection:
    selection:
        Provider_Name: Microsoft-Windows-Directory-Services-SAM  # Active Directory
        EventID:
            - 16990 # Object class and UserAccountControl validation failure
            - 16991 # SAM Account Name validation failure
    condition: selection