ResetNightmare

detections/endpoint/windows_ad_user_suspicious_upn_change.yml

@@ -0,0 +1,91 @@
+name: Windows AD User Suspicious UPN Change
+id: 81324b8b-46c0-4ca3-b9a1-d33638f21021
+version: 1
+creation_date: '2026-09-23'
+modification_date: '2026-09-23'
+author: Raven Tait, Splunk
+status: production
+type: TTP
+description: |-
+    The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738.
+    This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account.
+    The KDC then resolves a ptype=10 (NT-ENTERPRISE) Kerberos pre-authentication request against the spoofed UPN, issuing a kadmin/changepw TGT that can be used to change the target account's password via kpasswd (port 464).
+    Event 4738 is generated when a user account attribute is changed. This analytic filters to events where the SubjectUserSid equals the TargetSid (self-modification), the new UPN value is not a standard UPN (no @ sign), and the value is not a Windows placeholder.
+    A non-UPN value set on one's own account is anomalous and has no legitimate administrative use case.
+data_source:
+    - Windows Event Log Security 4738
+search: |-
+    `wineventlog_security`
+    EventCode=4738
+    UserPrincipalName="*"
+    NOT UserPrincipalName IN (
+        "-",
+        "",
+        "*@*",
+        "%%1793"
+    )
+    NOT SubjectUserSid IN (
+        "S-1-5-18",
+        "S-1-5-7"
+    )
+    NOT SubjectUserName IN (
+        "ANONYMOUS*",
+        "NT AUTHORITY*"
+    )
+
+    | where SubjectUserSid=TargetSid
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+
+      by dest SubjectUserName SubjectUserSid TargetUserName TargetSid UserPrincipalName
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_ad_user_suspicious_upn_change_filter`
+how_to_implement: |-
+    To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled.
+known_false_positives: |-
+    Administrators or identity management tools may legitimately set a UPN that does not contain an @ sign during account provisioning or migration workflows. Investigate the SubjectUserName and context to confirm.
+references:
+    - https://cravaterouge.com/articles/resetnightmare/
+    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912
+    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
+drilldown_searches:
+    - name: View the detection results for - "$SubjectUserName$"
+      search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$SubjectUserName$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: User [$SubjectUserName$] set their UPN to [$UserPrincipalName$] on $dest$
+    entity:
+        field: SubjectUserName
+        type: user
+        score: 50
+threat_objects:
+    - field: SubjectUserName
+      type: user
+analytic_story:
+    - Active Directory Kerberos Attacks
+asset_type: Endpoint
+cve:
+    - CVE-2026-27912
+mitre_attack_id:
+    - T1078.002
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log
+          source: XmlWinEventLog:Security
+          sourcetype: XmlWinEventLog
+      test_type: unit

detections/endpoint/windows_admin_password_changed_by_non_admin.yml

@@ -1,8 +1,8 @@
 name: Windows Admin Password Changed by Non-Admin
 id: 6d4c4d88-cd60-43a1-8c70-c74a9614f724
-version: 1
+version: 2
 creation_date: '2026-04-27'
-modification_date: '2026-04-27'
+modification_date: '2026-09-23'
 author: Raven Tait, Splunk
 status: production
 type: TTP
@@ -13,15 +13,27 @@ data_source:
 search: |-
     `wineventlog_security`
     EventCode=4723
-    | rex field=object_id "-(?<target_rid>\d+)$"
+    TargetSid IN (
+        "*500*",
+        "*512*",
+        "*513*",
+        "*518*",
+        "*519*",
+        "*520*"
+    )
+
+    | rex field=TargetSid "-(?<target_rid>\d+)$"
     | rex field=SubjectUserSid "-(?<subject_rid>\d+)$"
-    | where target_rid="500" OR tonumber(target_rid) IN (512,513,518,519,520)
+
+    | where tonumber(target_rid)=500 OR tonumber(target_rid) IN (512,513,518,519,520)
     | where tonumber(subject_rid) >= 1000
-    | where SubjectUserSid != object_id
+    | where subject_rid != target_rid
+
     | stats count min(_time) as firstTime
                   max(_time) as lastTime
-      by dest user object_id EventCode src_user
-         SubjectUserSid SubjectLogonId PrivilegeList
+
+      by dest TargetSid EventCode SubjectUserSid src_user TargetUserName
+
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_admin_password_changed_by_non_admin_filter`
@@ -41,17 +53,21 @@ drilldown_searches:
       name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 finding:
-    title: Non-Administrator account $src_user$ changed password of Admin account $user$ on $dest$.
+    title: Non-Administrator account [$src_user$] changed the password of the Admin account [$user$] on $dest$.
     entity:
         field: dest
         type: system
         score: 50
+threat_objects:
+    - field: src_user
+      type: user
 analytic_story:
     - Windows Privilege Escalation
     - BlueHammer
 asset_type: Endpoint
 cve:
     - CVE-2026-33825
+    - CVE-2026-27912
 mitre_attack_id:
     - T1068
     - T1543.003