Merge pull request #3484 from elhoim/add_samtheadmin

Add rule to detect samtheadmin computer name used by hacktool

rules/windows/builtin/security/win_susp_computer_name.yml

@@ -0,0 +1,36 @@
+title: Win Susp Computer Name Containing Samtheadmin
+id: 39698b3f-da92-4bc6-bfb5-645a98386e45
+status: experimental
+description: Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool
+author: elhoim
+date: 2022/09/09
+references:
+    - https://twitter.com/malmoeb/status/1511760068743766026
+    - https://github.com/WazeHell/sam-theadmin/blob/main/sam_the_admin.py
+    - https://github.com/helloexp/0day/blob/614227a7b9beb0e91e7e2c6a5e532e6f7a8e883c/00-CVE_EXP/CVE-2021-42287/sam-the-admin/sam_the_admin.py
+tags:
+    - cve.2021.42278
+    - cve.2021.42287
+    - attack.persistence
+    - attack.privilege_escalation
+    - attack.t1078
+logsource:
+    category: security
+    product: windows
+detection:
+    # Not adding an EventID on purpose to try to match on any event in security (including use of account), not just 4741 (computer account created)
+    selection1:
+        SamAccountName|startswith: 'SAMTHEADMIN-'
+        SamAccountName|endswith: '$'
+    selection2:
+        TargetUserName|startswith: 'SAMTHEADMIN-'
+        TargetUserName|endswith: '$'
+    condition: 1 of selection*
+fields:
+    - EventID
+    - SamAccountName
+    - SubjectUserName
+    - TargetUserName
+falsepositives:
+    - Unknown
+level: critical