huntrule

Windows Directory Services SAM Account Name Validation Failures Indicative of CVE-2021-42287 Attempt

Looks for Directory Services SAM validation failures (Event 16990/16991) that may indicate CVE-2021-42287 exploitation attempts.

FreeUnreviewedSigmamediumv1
title: Windows Directory Services SAM Account Name Validation Failures Indicative of CVE-2021-42287 Attempt
id: e3a80b2b-8dba-4a02-a5fb-0a55bfaac9eb
related:
  - id: 44bbff3e-4ca3-452d-a49a-6efa4cafa06f
    type: similar
  - id: e80a0fee-1a62-4419-b31e-0d0db6e6013a
    type: derived
status: test
description: This rule flags Windows Active Directory Directory Services events where SAM account name and object/class validation fail during processing in Microsoft-Windows-Directory-Services-SAM. Attackers may use these failures when attempting techniques consistent with CVE-2021-42287 exploitation to manipulate computer objects. It relies on Windows System telemetry from the Directory Services-SAM provider, specifically Event IDs 16990 and 16991.
references:
  - https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-42287/win_system_exploit_cve_2021_42287.yml
author: frack113, Huntrule Team
date: 2021-12-15
modified: 2023-04-14
tags:
  - attack.credential-access
  - attack.t1558.003
  - detection.emerging-threats
  - cve.2021-42287
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Microsoft-Windows-Directory-Services-SAM
    EventID:
      - 16990
      - 16991
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags Windows Active Directory Directory Services events where SAM account name and object/class validation fail during processing in Microsoft-Windows-Directory-Services-SAM. Attackers may use these failures when attempting techniques consistent with CVE-2021-42287 exploitation to manipulate computer objects. It relies on Windows System telemetry from the Directory Services-SAM provider, specifically Event IDs 16990 and 16991.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.