IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Remote Computer Account DnsHostName Update
editRemote Computer Account DnsHostName Update
editIdentifies the remote update to a computer account’s DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it’s highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges.
Rule type: eql
Rule indices:
- winlogbeat-*
- logs-system.*
- logs-windows.*
Severity: high
Risk score: 73
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
References:
Tags:
- Elastic
- Host
- Windows
- Threat Detection
- Privilege Escalation
- Active Directory
Version: 104
Rule authors:
- Elastic
Rule license: Elastic License v2
Rule query
editsequence by winlog.computer_name with maxspan=5m [authentication where host.os.type == "windows" and event.action == "logged-in" and winlog.logon.type == "Network" and event.outcome == "success" and not user.name == "ANONYMOUS LOGON" and not winlog.event_data.SubjectUserName : "*$" and not user.domain == "NT AUTHORITY" and source.ip != "127.0.0.1" and source.ip !="::1"] by winlog.event_data.TargetLogonId [iam where host.os.type == "windows" and event.action == "changed-computer-account" and /* if DnsHostName value equal a DC DNS hostname then it's highly suspicious */ winlog.event_data.DnsHostName : "??*" and /* exclude FPs where host.os.type == "windows" and DnsHostName starts with the ComputerName that was changed */ not startswith~(winlog.event_data.DnsHostName, substring(winlog.event_data.TargetUserName, 0, length(winlog.event_data.TargetUserName) - 1)) ] by winlog.event_data.SubjectLogonId
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Privilege Escalation
- ID: TA0004
- Reference URL: https://attack.mitre.org/tactics/TA0004/
-
Technique:
- Name: Exploitation for Privilege Escalation
- ID: T1068
- Reference URL: https://attack.mitre.org/techniques/T1068/
-
Technique:
- Name: Valid Accounts
- ID: T1078
- Reference URL: https://attack.mitre.org/techniques/T1078/
-
Sub-technique:
- Name: Domain Accounts
- ID: T1078.002
- Reference URL: https://attack.mitre.org/techniques/T1078/002/