CVE-2026-47301 - #4236
Conversation
Detections for coverage of CVE-2026-47301
onurmerdogan
left a comment
onurmerdogan
left a comment
There was a problem hiding this comment.
Thanks a lot Raven, looks great, just a few suggestions from my side.
| | rename Computer as dest | ||
| | stats count values(new_name) as new_account_names | ||
| min(_time) as firstTime max(_time) as lastTime | ||
| by dest old_name new_name target_sid logon_id |
There was a problem hiding this comment.
new_name is used in both aggregation and grouping, I think it would be good to use either one.
| earliest_offset: 7d | ||
| latest_offset: "0" | ||
| finding: | ||
| title: Built-in account [$old_name$] (SID $target_sid$) was renamed to [$new_account_names$] on [$dest$] |
There was a problem hiding this comment.
In case new_name field is updated as I stated above, it would be good to update the parameter here.
| field: dest | ||
| type: system | ||
| score: 50 | ||
| analytic_story: |
There was a problem hiding this comment.
It would be good to add threat objects for dest and new_name
There was a problem hiding this comment.
We do not add dest as a TO thats already a risk object via the finding/IF
| - Windows Defense Evasion Tactics | ||
| - Compromised Windows Host | ||
| asset_type: Endpoint | ||
| mitre_attack_id: |
There was a problem hiding this comment.
This TTP might be good to add, T1036.010: Masquerade Account Name
| known_false_positives: |- | ||
| Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts. | ||
| Validate the source user, logon ID, and timing against expected change control windows before tuning. | ||
| references: |
There was a problem hiding this comment.
It might be good to add reference to CVE, its helpful once someone searches for its coverage, and also gives additional context to reader/consumer.
There was a problem hiding this comment.
Well known SID guide from Microsoft would help reader understand the idea behind the detecion,
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations
| status: production | ||
| type: TTP | ||
| description: |- | ||
| The following analytic detects creation or modification of adsource.dll or other staging fiiles within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301. |
There was a problem hiding this comment.
Little typo with "fiiles".
| | `security_content_ctime(firstTime)` | ||
| | `security_content_ctime(lastTime)` | ||
| | `windows_suspicious_sccm_adsource_dll_filter` | ||
| how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. |
There was a problem hiding this comment.
Its probably good to mention that given folder should be monitored by the EID 11 within Sysmon config.
| field: dest | ||
| type: system | ||
| score: 50 | ||
| threat_objects: |
There was a problem hiding this comment.
dest would be good to add I guess.
| known_false_positives: |- | ||
| Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory. | ||
| Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning. | ||
| references: |
There was a problem hiding this comment.
Except SIDs reference, I suggest same as above.
| modification_date: '2026-08-24' | ||
| author: Raven Tait, Splunk | ||
| status: production | ||
| type: TTP |
There was a problem hiding this comment.
smsexec.exe spawns a lot of shell processes, therefore it might be good to consider turning this into an anomaly.
3 participants
Detections for coverage of CVE-2026-47301
Details
New Detections:
Windows Builtin Account Name Change
Windows Suspicious Child Process of smsexec
Windows Suspicious SCCM Adsource DLL
Updated Detections:
Windows CAB File on Disk