From 630c27a64ea68fdccf82a38f13ebb8a1b29e8031 Mon Sep 17 00:00:00 2001 From: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com> Date: Thu, 13 Aug 2026 14:48:19 +0545 Subject: [PATCH 1/2] new: resetnightmare rules --- ...ty_resetnightmare_upn_no_domain_suffix.yml | 42 ++++++++++++++++++ ...ity_privileged_account_password_change.yml | 44 +++++++++++++++++++ ...erberos_preauth_failed_kadmin_changepw.yml | 38 ++++++++++++++++ ..._security_kerberos_tgt_kadmin_changepw.yml | 36 +++++++++++++++ 4 files changed, 160 insertions(+) create mode 100644 rules-emerging-threats/2026/Exploits/CVE-2026-27912/win_security_resetnightmare_upn_no_domain_suffix.yml create mode 100644 rules/windows/builtin/security/account_management/win_security_privileged_account_password_change.yml create mode 100644 rules/windows/builtin/security/win_security_kerberos_preauth_failed_kadmin_changepw.yml create mode 100644 rules/windows/builtin/security/win_security_kerberos_tgt_kadmin_changepw.yml diff --git a/rules-emerging-threats/2026/Exploits/CVE-2026-27912/win_security_resetnightmare_upn_no_domain_suffix.yml b/rules-emerging-threats/2026/Exploits/CVE-2026-27912/win_security_resetnightmare_upn_no_domain_suffix.yml new file mode 100644 index 00000000000..5ec83ec4747 --- /dev/null +++ b/rules-emerging-threats/2026/Exploits/CVE-2026-27912/win_security_resetnightmare_upn_no_domain_suffix.yml @@ -0,0 +1,42 @@ +title: UPN Set Anomaly - ResetNightmare (CVE-2026-27912) +id: a3f8e2d1-7b4c-4e9a-b5f2-8c1d3a0e6b7f +status: experimental +description: | + Detects a userPrincipalName (UPN) being set to a value that does not contain an "@" symbol, + indicating it was set to a bare sAMAccountName rather than a proper UPN (e.g. "user@domain.com"). + This is the core step of the ResetNightmare (CVE-2026-27912) attack, where an attacker sets + their controlled account's UPN to the sAMAccountName of a high-value target (e.g. "Administrator") + to obtain a Kerberos TGT for the kadmin/changepw service that resolves to the target identity, + enabling a password reset without knowing the current credential. +references: + - https://github.com/semperis-community/resetnightmare + - https://www.ietf.org/proceedings/47/slides/calsch-security-00mar/tsld003.htm +author: Swachchhanda Shrawan Poudel (Nextron Systems) +date: 2026-08-12 +tags: + - attack.credential-access + - attack.persistence + - attack.privilege-escalation + - attack.t1098 + - attack.t1212 + - detection.emerging-threats + - cve.2026-27912 +logsource: + product: windows + service: security + definition: 'Requirements: Advanced Audit Policy "Audit User Account Management" must be enabled' +detection: + selection: + EventID: 4738 + UserPrincipalName: '*' + filter_main_legitimate_upn: + - UserPrincipalName|contains: '@' + - UserPrincipalName: + - '-' + - '%%1793' + filter_main_targetuser: + UserPrincipalName|fieldref: TargetUserName + condition: selection and not 1 of filter_main_* +falsepositives: + - Unlikely +level: high diff --git a/rules/windows/builtin/security/account_management/win_security_privileged_account_password_change.yml b/rules/windows/builtin/security/account_management/win_security_privileged_account_password_change.yml new file mode 100644 index 00000000000..32d4c7c38f2 --- /dev/null +++ b/rules/windows/builtin/security/account_management/win_security_privileged_account_password_change.yml @@ -0,0 +1,44 @@ +title: Password Change Attempt on Privileged Domain Account +id: f3a1d8e2-5c7b-4f0a-9e6d-2b4c8a1f3d7e +status: experimental +description: | + Detects password change (Event 4723) and password reset (Event 4724) activity targeting + privileged domain accounts such as built-in Administrator and krbtgt. Legitimate + password operations on these accounts are rare and should be tightly controlled. + This rule is particularly relevant to Kerberos Change Password protocol abuses such as + ResetNightmare (CVE-2026-27912), where the attacker uses a forged TGT to invoke the + Kerberos changepw protocol against the target — generating a 4723 rather than a 4724 + because the KDC processes it as a self-service change (SubjectUserName equals + TargetUserName). Note that the TargetUserName list should be extended with + environment-specific Domain Admin account names for broader coverage. +references: + - https://github.com/semperis-community/resetnightmare + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4723 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4724 +author: Swachchhanda Shrawan Poudel (Nextron Systems) +date: 2026-08-13 +tags: + - attack.credential-access + - attack.persistence + - attack.privilege-escalation + - attack.t1098 + - attack.t1212 + - attack.t1558 +logsource: + product: windows + service: security + definition: 'Requirements: Advanced Audit Policy "Audit User Account Management" must be enabled.' +detection: + selection: + EventID: + - 4723 # self-service password change + - 4724 # admin-initiated password reset + TargetUserName: + # Add environment-specific privileged accounts here for broader coverage like Domain Admins, Enterprise Admins, etc. + - 'Administrator' + - 'krbtgt' + condition: selection +falsepositives: + - Legitimate password rotation of privileged accounts by authorized administrators or PAM solutions + - Password manager or privileged access workstation tooling performing scheduled rotations +level: high diff --git a/rules/windows/builtin/security/win_security_kerberos_preauth_failed_kadmin_changepw.yml b/rules/windows/builtin/security/win_security_kerberos_preauth_failed_kadmin_changepw.yml new file mode 100644 index 00000000000..8cf99ed5775 --- /dev/null +++ b/rules/windows/builtin/security/win_security_kerberos_preauth_failed_kadmin_changepw.yml @@ -0,0 +1,38 @@ +title: Kerberos Pre-Authentication Failure Targeting Kadmin/changepw SPN +id: b5e3a1f7-2d8c-4b6e-a0f4-9c7d1e3b5a2f +status: experimental +description: | + Detects a Kerberos pre-authentication failure (Event 4771) where the target service is + "kadmin/changepw". This event fires when a client attempts an AS-REQ to the Kerberos + Change Password SPN but the KDC rejects it at the pre-authentication stage — common + during reconnaissance, credential guessing, or exploit attempts where the attacker has + not yet obtained valid credentials or a correct ticket. In Windows-native environments, + password changes go through NTLM or LDAP, so any direct AS-REQ to kadmin/changepw is + anomalous. Known techniques leveraging this SPN include ResetNightmare (CVE-2026-27912) + and other Kerberos Change Password protocol abuses. Lower confidence than a successful + 4768 event but useful for early-stage detection and baselining. +references: + - https://github.com/semperis-community/resetnightmare + - https://github.com/GhostPack/Rubeus + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771 +author: Swachchhanda Shrawan Poudel (Nextron Systems) +date: 2026-08-12 +tags: + - attack.credential-access + - attack.persistence + - attack.privilege-escalation + - attack.t1558 + - attack.t1212 +logsource: + product: windows + service: security + definition: 'Requirements: Advanced Audit Policy "Audit Kerberos Authentication Service" must be enabled' +detection: + selection: + EventID: 4771 + ServiceName: 'kadmin/changepw' + condition: selection +falsepositives: + - Non-Windows Kerberos clients (Linux, macOS, MIT Kerberos) performing standard RFC 3244 Kerberos password changes against the Windows DC + - Misconfigured Kerberos clients or password change tooling retrying after transient failures +level: medium diff --git a/rules/windows/builtin/security/win_security_kerberos_tgt_kadmin_changepw.yml b/rules/windows/builtin/security/win_security_kerberos_tgt_kadmin_changepw.yml new file mode 100644 index 00000000000..169b5f78df5 --- /dev/null +++ b/rules/windows/builtin/security/win_security_kerberos_tgt_kadmin_changepw.yml @@ -0,0 +1,36 @@ +title: Kerberos TGT Issued for kadmin/changepw SPN +id: c7d2b4f8-3a5e-4c1b-9f6d-2e8a0b4c7d3f +status: experimental +description: | + Detects a successful Kerberos TGT request (AS-REQ/AS-REP, Event 4768) where the target + service is "kadmin/changepw". In Windows-native environments, password changes go through + NTLM or LDAP — a successful AS-REQ to the kadmin/changepw SPN from a Windows host means + the KDC issued a usable ticket, indicating offensive Kerberos tooling such as Rubeus + ("asktgt /changepw"), Impacket, or custom exploit code. Known techniques leveraging this + primitive include ResetNightmare (CVE-2026-27912) and other Kerberos Change Password + protocol abuses. A successfully issued ticket is a high-confidence indicator; the attacker + already holds a credential capable of invoking the Kerberos Change Password protocol. +references: + - https://github.com/semperis-community/resetnightmare + - https://github.com/GhostPack/Rubeus + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768 +author: Swachchhanda Shrawan Poudel (Nextron Systems) +date: 2026-08-12 +tags: + - attack.credential-access + - attack.persistence + - attack.privilege-escalation + - attack.t1558 + - attack.t1212 +logsource: + product: windows + service: security + definition: 'Requirements: Advanced Audit Policy "Audit Kerberos Authentication Service" must be enabled' +detection: + selection: + EventID: 4768 + ServiceName: 'kadmin/changepw' + condition: selection +falsepositives: + - Non-Windows Kerberos clients (Linux, macOS, MIT Kerberos) performing standard RFC 3244 Kerberos password changes against the Windows DC +level: high From ee6d518849ed3299e11c12a60ebb4ec0dd8dfa29 Mon Sep 17 00:00:00 2001 From: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com> Date: Thu, 13 Aug 2026 15:13:23 +0545 Subject: [PATCH 2/2] fix: fp --- .../win_security_privileged_account_password_change.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/rules/windows/builtin/security/account_management/win_security_privileged_account_password_change.yml b/rules/windows/builtin/security/account_management/win_security_privileged_account_password_change.yml index 32d4c7c38f2..287307fdc42 100644 --- a/rules/windows/builtin/security/account_management/win_security_privileged_account_password_change.yml +++ b/rules/windows/builtin/security/account_management/win_security_privileged_account_password_change.yml @@ -37,7 +37,11 @@ detection: # Add environment-specific privileged accounts here for broader coverage like Domain Admins, Enterprise Admins, etc. - 'Administrator' - 'krbtgt' - condition: selection + filter_main_machine_administrator: + EventID: 4724 + SubjectUserName|endswith: '$' + TargetUserName: 'Administrator' + condition: selection and not 1 of filter_main_* falsepositives: - Legitimate password rotation of privileged accounts by authorized administrators or PAM solutions - Password manager or privileged access workstation tooling performing scheduled rotations