Potential CVE-2021-42287 Exploitation Attempt

Title: Potential CVE-2021-42287 Exploitation Attempt
Status: test
Description:The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.
References:
  -https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
Author: frack113
Date: 2021-12-15
modified:2023-04-14
Tags:

• -'attack.credential-access'
• -'attack.t1558.003'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Microsoft-Windows-Directory-Services-SAM'
    EventID:
      -'16990'
      -'16991'

  condition:selection
Falsepositives:
  -Unknown
Level: medium