-
Remote Computer Account DnsHostName Update
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Use Case: Vulnerability Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows Vuln: CVE-2022-26923 ·Identifies the remote update to a computer account's DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it's highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges.
Read More