Windows Security: Detect Computer Account Renamed to Missing $ Suffix

title: "Windows Security: Detect Computer Account Renamed to Missing $ Suffix"
id: 3ea34a32-4f6a-47bc-93a8-ba5266ec2f3c
status: test
description: This rule flags Windows Security event ID 4781 where an existing computer account is renamed and the new computer account name does not contain the required '$' suffix. Attackers may use computer account renaming to evade detection or enable persistence/privilege-escalation behaviors associated with SAM account name spoofing patterns. It relies on telemetry from Windows Security logs capturing the old and new target user names during account rename operations.
references:
  - https://medium.com/@mvelazco/hunting-for-samaccountname-spoofing-cve-2021-42287-and-domain-controller-impersonation-f704513c8a45
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-42287/win_security_samaccountname_spoofing_cve_2021_42287.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-22
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.stealth
  - attack.t1036
  - attack.t1098
  - cve.2021-42287
  - detection.emerging-threats
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4781
    OldTargetUserName|contains: $
  filter:
    NewTargetUserName|contains: $
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 45eb2ae2-9aa2-4c3a-99a5-6e5077655466
    type: derived