SAM-Name-Changes-CVE-2021-42278

Description

The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity

Query · kql

IdentityDirectoryEvents
| where Timestamp > ago(1d)
| where ActionType == "SAM Account Name changed"
| extend FROMSAM = parse_json(AdditionalFields)['FROM SAM Account Name']
| extend TOSAM = parse_json(AdditionalFields)['TO SAM Account Name']
| where (FROMSAM has "$" and TOSAM !has "$") 
        or TOSAM in ("DC1", "DC2", "DC3", "DC4") // DC Names in the org
| project Timestamp, Application, ActionType, TargetDeviceName, FROMSAM, TOSAM, ReportId, AdditionalFields
Raw source SAM-Name-Changes-CVE-2021-42278 · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 89ce68d5-dd48-4f3f-b102-336fc4ebdda9
name: SAM-Name-Changes-CVE-2021-42278
description: |
  The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - IdentityDirectoryEvents
tactics:
- Privilege escalation
- Vulnerability
query: |
  IdentityDirectoryEvents
  | where Timestamp > ago(1d)
  | where ActionType == "SAM Account Name changed"
  | extend FROMSAM = parse_json(AdditionalFields)['FROM SAM Account Name']
  | extend TOSAM = parse_json(AdditionalFields)['TO SAM Account Name']
  | where (FROMSAM has "$" and TOSAM !has "$") 
          or TOSAM in ("DC1", "DC2", "DC3", "DC4") // DC Names in the org
  | project Timestamp, Application, ActionType, TargetDeviceName, FROMSAM, TOSAM, ReportId, AdditionalFields

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.