-
Potential Privileged Escalation via SamAccountName Spoofing
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Use Case: Vulnerability Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows Vuln: CVE-2021-42278 ·Identifies a suspicious computer account name rename event, which may indicate an attempt to exploit CVE-2021-42278 to elevate privileges from a standard domain user to a user with domain admin privileges. CVE-2021-42278 is a security vulnerability that allows potential attackers to impersonate a domain controller via samAccountName attribute spoofing.
Read More