Remote Computer Account DnsHostName Update

Author: Elastic
Source: upstream

Identifies the remote update to a computer account's DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it's highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts, `T1078.002` Valid Accounts: Domain Accounts
Persistence	`T1078` Valid Accounts, `T1078.002` Valid Accounts: Domain Accounts, `T1098` Account Manipulation
Privilege Escalation	`T1068` Exploitation for Privilege Escalation, `T1078` Valid Accounts, `T1078.002` Valid Accounts: Domain Accounts, `T1098` Account Manipulation
Defense Evasion	`T1078` Valid Accounts, `T1078.002` Valid Accounts: Domain Accounts

Event coverage

Provider	Event ID	Title
Security-Auditing	4742	A computer account was changed.

Stages and Predicates

Stage 1: `eql:iam`

not winlog.event_data.DnsHostName starts_with and event.action:"changed-computer-account" and user.id:"S-1-5-21-*" and winlog.event_data.DnsHostName:"??*"

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

Stage	Field	Kind	Excluded values
1	`DnsHostName`	starts_with	(no value — null check)

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`event.action`	eq	`changed-computer-account`
`user.id`	wildcard	`S-1-12-1-` corpus 3 (elastic 3) `S-1-5-21-` corpus 3 (elastic 3)
`winlog.event_data.DnsHostName`	wildcard	`??*`