Win Susp Computer Name Containing Samtheadmin

Title: Win Susp Computer Name Containing Samtheadmin
Status: test
Description:Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool
References:
  -https://twitter.com/malmoeb/status/1511760068743766026
  -https://github.com/helloexp/0day/blob/614227a7b9beb0e91e7e2c6a5e532e6f7a8e883c/00-CVE_EXP/CVE-2021-42287/sam-the-admin/sam_the_admin.py
Author: elhoim
Date: 2022-09-09
modified:2023-01-04
Tags:

• -'attack.initial-access'
• -'cve.2021-42278'
• -'cve.2021-42287'
• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1078'

Logsource:

• service: security
• product: windows

Detection:
  selection1:
    SamAccountName|startswith: 'SAMTHEADMIN-'
    SamAccountName|endswith: '$'
  selection2:
    TargetUserName|startswith: 'SAMTHEADMIN-'
    TargetUserName|endswith: '$'
  condition:1 of selection*
Falsepositives:
  -Unknown
Level: critical