new: resetnightmare rules

rules-emerging-threats/2026/Exploits/CVE-2026-27912/win_security_resetnightmare_upn_no_domain_suffix.yml

@@ -0,0 +1,42 @@
+title: UPN Set Anomaly - ResetNightmare (CVE-2026-27912)
+id: a3f8e2d1-7b4c-4e9a-b5f2-8c1d3a0e6b7f
+status: experimental
+description: |
+    Detects a userPrincipalName (UPN) being set to a value that does not contain an "@" symbol,
+    indicating it was set to a bare sAMAccountName rather than a proper UPN (e.g. "[email protected]").
+    This is the core step of the ResetNightmare (CVE-2026-27912) attack, where an attacker sets
+    their controlled account's UPN to the sAMAccountName of a high-value target (e.g. "Administrator")
+    to obtain a Kerberos TGT for the kadmin/changepw service that resolves to the target identity,
+    enabling a password reset without knowing the current credential.
+references:
+    - https://github.com/semperis-community/resetnightmare
+    - https://www.ietf.org/proceedings/47/slides/calsch-security-00mar/tsld003.htm
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2026-08-12
+tags:
+    - attack.credential-access
+    - attack.persistence
+    - attack.privilege-escalation
+    - attack.t1098
+    - attack.t1212
+    - detection.emerging-threats
+    - cve.2026-27912
+logsource:
+    product: windows
+    service: security
+    definition: 'Requirements: Advanced Audit Policy "Audit User Account Management" must be enabled'
+detection:
+    selection:
+        EventID: 4738
+        UserPrincipalName: '*'
+    filter_main_legitimate_upn:
+        - UserPrincipalName|contains: '@'
+        - UserPrincipalName:
+              - '-'
+              - '%%1793'
+    filter_main_targetuser:
+        UserPrincipalName|fieldref: TargetUserName
+    condition: selection and not 1 of filter_main_*
+falsepositives:
+    - Unlikely
+level: high

rules/windows/builtin/security/account_management/win_security_privileged_account_password_change.yml

@@ -0,0 +1,48 @@
+title: Password Change Attempt on Privileged Domain Account
+id: f3a1d8e2-5c7b-4f0a-9e6d-2b4c8a1f3d7e
+status: experimental
+description: |
+    Detects password change (Event 4723) and password reset (Event 4724) activity targeting
+    privileged domain accounts such as built-in Administrator and krbtgt. Legitimate
+    password operations on these accounts are rare and should be tightly controlled.
+    This rule is particularly relevant to Kerberos Change Password protocol abuses such as
+    ResetNightmare (CVE-2026-27912), where the attacker uses a forged TGT to invoke the
+    Kerberos changepw protocol against the target — generating a 4723 rather than a 4724
+    because the KDC processes it as a self-service change (SubjectUserName equals
+    TargetUserName). Note that the TargetUserName list should be extended with
+    environment-specific Domain Admin account names for broader coverage.
+references:
+    - https://github.com/semperis-community/resetnightmare
+    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4723
+    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4724
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2026-08-13
+tags:
+    - attack.credential-access
+    - attack.persistence
+    - attack.privilege-escalation
+    - attack.t1098
+    - attack.t1212
+    - attack.t1558
+logsource:
+    product: windows
+    service: security
+    definition: 'Requirements: Advanced Audit Policy "Audit User Account Management" must be enabled.'
+detection:
+    selection:
+        EventID:
+            - 4723 # self-service password change
+            - 4724 # admin-initiated password reset
+        TargetUserName:
+            # Add environment-specific privileged accounts here for broader coverage like Domain Admins, Enterprise Admins, etc.
+            - 'Administrator'
+            - 'krbtgt'
+    filter_main_machine_administrator:
+        EventID: 4724
+        SubjectUserName|endswith: '$'
+        TargetUserName: 'Administrator'
+    condition: selection and not 1 of filter_main_*
+falsepositives:
+    - Legitimate password rotation of privileged accounts by authorized administrators or PAM solutions
+    - Password manager or privileged access workstation tooling performing scheduled rotations
+level: high

rules/windows/builtin/security/win_security_kerberos_preauth_failed_kadmin_changepw.yml

@@ -0,0 +1,38 @@
+title: Kerberos Pre-Authentication Failure Targeting Kadmin/changepw SPN
+id: b5e3a1f7-2d8c-4b6e-a0f4-9c7d1e3b5a2f
+status: experimental
+description: |
+    Detects a Kerberos pre-authentication failure (Event 4771) where the target service is
+    "kadmin/changepw". This event fires when a client attempts an AS-REQ to the Kerberos
+    Change Password SPN but the KDC rejects it at the pre-authentication stage — common
+    during reconnaissance, credential guessing, or exploit attempts where the attacker has
+    not yet obtained valid credentials or a correct ticket. In Windows-native environments,
+    password changes go through NTLM or LDAP, so any direct AS-REQ to kadmin/changepw is
+    anomalous. Known techniques leveraging this SPN include ResetNightmare (CVE-2026-27912)
+    and other Kerberos Change Password protocol abuses. Lower confidence than a successful
+    4768 event but useful for early-stage detection and baselining.
+references:
+    - https://github.com/semperis-community/resetnightmare
+    - https://github.com/GhostPack/Rubeus
+    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2026-08-12
+tags:
+    - attack.credential-access
+    - attack.persistence
+    - attack.privilege-escalation
+    - attack.t1558
+    - attack.t1212
+logsource:
+    product: windows
+    service: security
+    definition: 'Requirements: Advanced Audit Policy "Audit Kerberos Authentication Service" must be enabled'
+detection:
+    selection:
+        EventID: 4771
+        ServiceName: 'kadmin/changepw'
+    condition: selection
+falsepositives:
+    - Non-Windows Kerberos clients (Linux, macOS, MIT Kerberos) performing standard RFC 3244 Kerberos password changes against the Windows DC
+    - Misconfigured Kerberos clients or password change tooling retrying after transient failures
+level: medium

rules/windows/builtin/security/win_security_kerberos_tgt_kadmin_changepw.yml

@@ -0,0 +1,36 @@
+title: Kerberos TGT Issued for kadmin/changepw SPN
+id: c7d2b4f8-3a5e-4c1b-9f6d-2e8a0b4c7d3f
+status: experimental
+description: |
+    Detects a successful Kerberos TGT request (AS-REQ/AS-REP, Event 4768) where the target
+    service is "kadmin/changepw". In Windows-native environments, password changes go through
+    NTLM or LDAP — a successful AS-REQ to the kadmin/changepw SPN from a Windows host means
+    the KDC issued a usable ticket, indicating offensive Kerberos tooling such as Rubeus
+    ("asktgt /changepw"), Impacket, or custom exploit code. Known techniques leveraging this
+    primitive include ResetNightmare (CVE-2026-27912) and other Kerberos Change Password
+    protocol abuses. A successfully issued ticket is a high-confidence indicator; the attacker
+    already holds a credential capable of invoking the Kerberos Change Password protocol.
+references:
+    - https://github.com/semperis-community/resetnightmare
+    - https://github.com/GhostPack/Rubeus
+    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2026-08-12
+tags:
+    - attack.credential-access
+    - attack.persistence
+    - attack.privilege-escalation
+    - attack.t1558
+    - attack.t1212
+logsource:
+    product: windows
+    service: security
+    definition: 'Requirements: Advanced Audit Policy "Audit Kerberos Authentication Service" must be enabled'
+detection:
+    selection:
+        EventID: 4768
+        ServiceName: 'kadmin/changepw'
+    condition: selection
+falsepositives:
+    - Non-Windows Kerberos clients (Linux, macOS, MIT Kerberos) performing standard RFC 3244 Kerberos password changes against the Windows DC
+level: high