noPac (sAMAccountName Spoofing)
Also calledsAMAccountName spoofing, CVE-2021-42278, CVE-2021-42287
A renamed computer account makes a ticket name a privileged account.
- Hooks Into
- Kerberos TGS Request
- Needs
- Domain Account
- Gives
- Domain Admin
How the Attack Works
The November 2021 updates (KB5008380) close this, so on a patched domain a defender reads it as an exposure check rather than a live threat. Two 2021 flaws, CVE-2021-42278 and CVE-2021-42287, let a created computer account be renamed to a domain controller's own name, so a ticket later issued for it named the privileged account the directory still held under that name. A defender confirms the updates are in place, then looks for a computer account created and quickly renamed to a controller's name, and for the KDC hardening events a patched controller writes when a ticket and the account behind it disagree.
Read first The PAC and Its Signatures, TGS Request
How It Plays Out
The attack step by step. Each step shows which machines take part, what travels, the keys and tickets each side now holds, what is logged and what a defender can see.
ws-042 Foothold
dc-01 Domain controller
Step 1 of 3: Computer Created
ws-042 Foothold to dc-01 Domain controller
A new computer account
LDAP AddRequestLDAP, port 389A computer account is created in the directory from ws-042, which any domain account may do by default.
Logged
4741 A computer account was created
On dc-01, in the Security log When enabled
A computer account created from ws-042.
What Defenders See
With Audit Computer Account Management on, dc-01 writes event 4741 for the new computer account.
Step 2 of 3: Renamed to a DC
ws-042 Foothold to dc-01 Domain controller
The account renamed
LDAP ModifyRequestLDAP, port 389That computer account is renamed to a domain controller's own name, so two objects now answer to one name.
Logged
4781 The name of an account was changed
On dc-01, in the Security log When enabled
A computer account renamed to a domain controller's name.
What Defenders See
With Audit User Account Management on, dc-01 writes event 4781 showing the old and new names, the new one a controller's.
Step 3 of 3: Ticket Names the DC
ws-042 Foothold to dc-01 Domain controller
A ticket for that name
KRB_TGS_REQKerberos, port 88A later service-ticket request resolves to the privileged account the directory still holds under that name.
Logged
35 to 38 PAC without attributes, Ticket without a PAC, Ticket without Requestor, Requestor Mismatch
On dc-01, in the System log
A ticket whose account does not match the directory, refused by a patched controller.
What Defenders See
A patched controller refuses it and writes KDC PAC events 35 to 38 in the System log. Defender for Identity raises its sAMAccountName and golden-ticket alerts.
Hooks into Kerberos TGS Request
Needs First
What the attacker must already hold for this attack to be possible.
- A Domain AccountAny domain account, since by default a user may create computer accounts.
Comes From
- Domain Account: Password Spraying
Gives the Attacker
What running it hands the attacker to use next.
- Domain Admin RightsOn an unpatched domain, a ticket issued as the privileged account the renamed computer matched.
What Defenders See
What this attack leaves for a defender to find, and what to read in each. None of it is proof on its own, so treat each as a lead and confirm it against the rest.
| Event and Log | Written On | Look For | Switch It On |
|---|---|---|---|
| 4741 A computer account was created (opens in a new tab) Security log | Domain controllers | A computer account created by an ordinary user shortly before a rename, worth running down on a domain that should see few. | Audit Computer Account Management |
| 4781 The name of an account was changed (opens in a new tab) Security log | Domain controllers for computer accounts, and for domain user accounts | A computer account renamed to a domain controller's own name, the Old and New Account Name fields naming a controller. | Audit User Account Management |
| 35 to 38 PAC without attributes, Ticket without a PAC, Ticket without Requestor, Requestor Mismatch (opens in a new tab) System log | Domain controllers | A ticket whose account does not match the directory, refused by a controller with the November 2021 updates since the PAC hardening. | Domain controllers with the November 2021 or later updates (KB5008380) |
What It Looks Like
One event from the worked example, decoded field by field, so you can see what to read in it and what each value means.
4781 The name of an account was changed
In the Security log on dc-01,
A computer account on dc-01 renamed to a domain controller's own name.
The name the computer account was created with. A machine made minutes earlier and renamed at once is the pattern to run down.
As Windows writes it:
Old Account NameWIN-TMP42$The new name, a domain controller's own, but without the trailing dollar the real account has. Two objects now answer to one name.
As Windows writes it:
New Account NameDC-01The account that made the change, an ordinary user. Renaming computer accounts is not its work, so find where it signed in from.
As Windows writes it:
Subject AccountCORP\dana
Defender for Identity Alerts
Where Defender for Identity runs, its sensors raise these from what they read on the servers they are installed on, domain controllers above all. Each names what it flags, which is a lead to confirm, not proof on its own.
- Suspicious modification of a sAMNameAccount attribute (CVE-2021-42278 and CVE-2021-42287 exploitation) (opens in a new tab)
- Suspicious SAM Account Name Change (opens in a new tab)A computer account's name changed to one it should not carry.
- Possible golden ticket attack (CVE-2021-42287 exploitation) (opens in a new tab)The golden-ticket-style ticket that follows, naming the account the rename matched.
Blind Spots
Where this attack leaves little or nothing to see, so a quiet log is not read as an all-clear.
- On a domain with the November 2021 updates the ticket request is refused, so treat a renamed computer account as the lead rather than waiting for a successful takeover.
- Event 4741 needs Audit Computer Account Management on, so without it the creation that starts the rename leaves no Security event.
Hunt It
The query to run in each tool, and how well each one sees this attack. Pick the tool you use, and the others load their query when you open them.
Needs Defender for Identity sensors on every DC. The alert fires on a name change to a controller's name and on the golden-ticket-style ticket that follows. An alert is a lead to confirm in the created-then-renamed trail in the Security log, not proof.
// Defender for Identity sAMAccountName and golden-ticket alerts, with the accounts, machines and addresses they nameAlertEvidence| where Timestamp > ago(How to Prevent It
The controls that break this attack, each with how it helps here and, where the Registry topic has it, where to check it on a machine.
MachineAccountQuota at zero (opens in a new tab)
Set MachineAccountQuota to zero, so an ordinary user cannot create the computer account the rename starts from.
Tiered administration (opens in a new tab)
Keep admin accounts and their workstations apart, so a foothold is not already where a controller's name can be claimed.
Least-privilege administration (opens in a new tab)
Keep the right to create and rename computer accounts in as few hands as possible.
Sources
- MITRE ATT&CK T1068: Exploitation for Privilege Escalation (opens in a new tab)
- Microsoft Support: KB5008380, Active Directory security accounts updates (November 2021) (opens in a new tab)
- Microsoft Learn: 4741, a computer account was created (opens in a new tab)
- Microsoft Learn: 4781, the name of an account was changed (opens in a new tab)
- Microsoft Learn: Defender for Identity credential access alerts (opens in a new tab)
- Microsoft Learn: Defender for Identity credential access alerts (XDR) (opens in a new tab)