Detection rules › Elastic
Potential Privileged Escalation via SamAccountName Spoofing
Identifies a suspicious computer account name rename event, which may indicate an attempt to exploit CVE-2021-42278 to elevate privileges from a standard domain user to a user with domain admin privileges. CVE-2021-42278 is a security vulnerability that allows potential attackers to impersonate a domain controller via samAccountName attribute spoofing.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
| Persistence | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts, T1098 Account Manipulation |
| Privilege Escalation | T1068 Exploitation for Privilege Escalation, T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts, T1098 Account Manipulation |
| Defense Evasion | T1036 Masquerading, T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 4781 | The name of an account was changed. |
Stages and Predicates
Stage 1: eql:iam
not winlog.event_data.NewTargetUserName:"*$" and event.action:"renamed-user-account" and winlog.event_data.OldTargetUserName:"*$"Exclusions
Top-level NOT(...) conjuncts — predicates this rule actively suppresses.
| Stage | Field | Kind | Excluded values |
|---|---|---|---|
| 1 | NewTargetUserName | ends_with | $ |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
event.action | eq |
|
winlog.event_data.OldTargetUserName | wildcard |
|