Windows Security: Suspicious SAMTHEADMIN-* Computer Account Names

title: "Windows Security: Suspicious SAMTHEADMIN-* Computer Account Names"
id: 25059ffa-b522-462c-981b-a8f15ced8a98
status: test
description: This rule flags Windows Security events where a computer account name matching the pattern "SAMTHEADMIN-<number>$" appears in either SamAccountName or TargetUserName. Such naming is used by hacktools to generate large numbers of likely computer-account identities for stealthy initial access or persistence. It relies on the presence of these fields in Windows Security telemetry to identify the suspicious account-name structure.
references:
  - https://twitter.com/malmoeb/status/1511760068743766026
  - https://github.com/helloexp/0day/blob/614227a7b9beb0e91e7e2c6a5e532e6f7a8e883c/00-CVE_EXP/CVE-2021-42287/sam-the-admin/sam_the_admin.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_computer_name.yml
author: elhoim, Huntrule Team
date: 2022-09-09
modified: 2023-01-04
tags:
  - attack.initial-access
  - cve.2021-42278
  - cve.2021-42287
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078
logsource:
  service: security
  product: windows
detection:
  selection1:
    SamAccountName|startswith: SAMTHEADMIN-
    SamAccountName|endswith: $
  selection2:
    TargetUserName|startswith: SAMTHEADMIN-
    TargetUserName|endswith: $
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 39698b3f-da92-4bc6-bfb5-645a98386e45
    type: derived