Potential CVE-2021-42287 Exploitation Attempt

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

title: Potential CVE-2021-42287 Exploitation Attempt
id: e80a0fee-1a62-4419-b31e-0d0db6e6013a
related:
    - id: 44bbff3e-4ca3-452d-a49a-6efa4cafa06f
      type: similar
status: test
description: |
    The attacker creates a computer object using those permissions with a password known to her.
    After that she clears the attribute ServicePrincipalName on the computer object.
    Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.
references:
    - https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
author: frack113
date: 2021-12-15
modified: 2023-04-14
tags:
    - attack.credential-access
    - attack.t1558.003
    - detection.emerging-threats
    - cve.2021-42287
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: Microsoft-Windows-Directory-Services-SAM  # Active Directory
        EventID:
            - 16990 # Object class and UserAccountControl validation failure
            - 16991 # SAM Account Name validation failure
    condition: selection
falsepositives:
    - Unknown
level: medium

• T1558.003Kerberoasting

• https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/↗