cve.2021-42278 | Detection.FYI

Win Susp Computer Name Containing Samtheadmin

Oct 23, 2025 · attack.initial-access attack.defense-evasion cve.2021-42278 cve.2021-42287 attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Read More
Potential CVE-2021-42278 Exploitation Attempt

Aug 12, 2024 · attack.credential-access attack.t1558.003 cve.2021-42278 detection.emerging-threats ·
Share on:

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Read More