Potential Privileged Escalation via SamAccountName Spoofing

  1[metadata]
  2creation_date = "2021/12/12"
  3integration = ["system", "windows"]
  4maturity = "production"
  5updated_date = "2025/01/15"
  6min_stack_version = "8.14.0"
  7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies a suspicious computer account name rename event, which may indicate an attempt to exploit CVE-2021-42278 to
 13elevate privileges from a standard domain user to a user with domain admin privileges. CVE-2021-42278 is a security
 14vulnerability that allows potential attackers to impersonate a domain controller via samAccountName attribute spoofing.
 15"""
 16from = "now-9m"
 17index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
 18language = "eql"
 19license = "Elastic License v2"
 20name = "Potential Privileged Escalation via SamAccountName Spoofing"
 21references = [
 22    "https://support.microsoft.com/en-us/topic/kb5008102-active-directory-security-accounts-manager-hardening-changes-cve-2021-42278-5975b463-4c95-45e1-831a-d120004e258e",
 23    "https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/",
 24    "https://github.com/cube0x0/noPac",
 25    "https://twitter.com/exploitph/status/1469157138928914432",
 26    "https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html",
 27]
 28risk_score = 73
 29rule_id = "bdcf646b-08d4-492c-870a-6c04e3700034"
 30setup = """## Setup
 31
 32If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
 33events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
 34Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
 35`event.ingested` to @timestamp.
 36For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
 37"""
 38severity = "high"
 39tags = [
 40    "Domain: Endpoint",
 41    "OS: Windows",
 42    "Use Case: Threat Detection",
 43    "Tactic: Persistence",
 44    "Tactic: Privilege Escalation",
 45    "Use Case: Active Directory Monitoring",
 46    "Data Source: Active Directory",
 47    "Use Case: Vulnerability",
 48    "Data Source: System",
 49    "Resources: Investigation Guide",
 50]
 51timestamp_override = "event.ingested"
 52type = "eql"
 53
 54query = '''
 55iam where event.action == "renamed-user-account" and
 56  /* machine account name renamed to user like account name */
 57  winlog.event_data.OldTargetUserName : "*$" and not winlog.event_data.NewTargetUserName : "*$"
 58'''
 59note = """## Triage and analysis
 60
 61> **Disclaimer**:
 62> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 63
 64### Investigating Potential Privileged Escalation via SamAccountName Spoofing
 65
 66In Active Directory environments, the samAccountName attribute is crucial for identifying user and computer accounts. Adversaries may exploit vulnerabilities like CVE-2021-42278 to spoof this attribute, potentially elevating privileges by renaming computer accounts to mimic domain controllers. The detection rule identifies suspicious renaming events, where a machine account is altered to resemble a user account, signaling possible privilege escalation attempts.
 67
 68### Possible investigation steps
 69
 70- Review the event logs to confirm the occurrence of a "renamed-user-account" action, focusing on entries where the OldTargetUserName ends with a "$" and the NewTargetUserName does not, indicating a potential spoofing attempt.
 71- Identify the source of the rename event by examining the event logs for the user or system that initiated the change, and determine if it aligns with expected administrative activity.
 72- Check the history of the NewTargetUserName to see if it has been used in any recent authentication attempts or privileged operations, which could indicate malicious intent.
 73- Investigate the associated IP address and hostname from which the rename action was performed to determine if it is a known and trusted source within the network.
 74- Correlate the event with other security alerts or logs to identify any patterns or additional suspicious activities that might suggest a broader attack campaign.
 75- Assess the potential impact by determining if the renamed account has been granted elevated privileges or access to sensitive resources since the rename event occurred.
 76
 77### False positive analysis
 78
 79- Routine administrative tasks involving legitimate renaming of computer accounts can trigger false positives. To manage this, create exceptions for known administrative activities by excluding specific administrator accounts or service accounts from the detection rule.
 80- Automated processes or scripts that rename computer accounts as part of regular maintenance or deployment procedures may also cause false alerts. Identify these processes and exclude their associated accounts or event patterns from the rule.
 81- Temporary renaming of computer accounts for troubleshooting or testing purposes can be mistaken for suspicious activity. Document and exclude these temporary changes by maintaining a list of authorized personnel and their activities.
 82- Changes made by trusted third-party software or management tools that interact with Active Directory should be reviewed and, if deemed safe, excluded from triggering alerts by specifying the tool's account or signature in the rule exceptions.
 83
 84### Response and remediation
 85
 86- Immediately isolate the affected machine from the network to prevent further unauthorized access or lateral movement within the domain.
 87- Revert any unauthorized changes to the samAccountName attribute by renaming the affected computer account back to its original name.
 88- Conduct a thorough review of recent changes in Active Directory, focusing on user and computer account modifications, to identify any other potentially compromised accounts.
 89- Reset passwords for the affected machine account and any other accounts that may have been accessed or modified during the incident.
 90- Apply the latest security patches and updates to all domain controllers and critical systems to mitigate vulnerabilities like CVE-2021-42278.
 91- Enhance monitoring and logging for Active Directory events, specifically focusing on account renaming activities, to detect similar threats in the future.
 92- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to ensure comprehensive remediation efforts are undertaken."""
 93
 94
 95[[rule.threat]]
 96framework = "MITRE ATT&CK"
 97[[rule.threat.technique]]
 98id = "T1068"
 99name = "Exploitation for Privilege Escalation"
100reference = "https://attack.mitre.org/techniques/T1068/"
101
102[[rule.threat.technique]]
103id = "T1078"
104name = "Valid Accounts"
105reference = "https://attack.mitre.org/techniques/T1078/"
106[[rule.threat.technique.subtechnique]]
107id = "T1078.002"
108name = "Domain Accounts"
109reference = "https://attack.mitre.org/techniques/T1078/002/"
110
111
112
113[rule.threat.tactic]
114id = "TA0004"
115name = "Privilege Escalation"
116reference = "https://attack.mitre.org/tactics/TA0004/"
117[[rule.threat]]
118framework = "MITRE ATT&CK"
119[[rule.threat.technique]]
120id = "T1098"
121name = "Account Manipulation"
122reference = "https://attack.mitre.org/techniques/T1098/"
123
124
125[rule.threat.tactic]
126id = "TA0003"
127name = "Persistence"
128reference = "https://attack.mitre.org/tactics/TA0003/"