CVE-2021-42287

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4738 or EventID == 4739 or EventID == 4728 or EventID == 4732 or EventID == 4756 or EventID == 4767 // Account modification, group membership changes
| where Account != "ANONYMOUS LOGON" and Account != "NT AUTHORITY\SYSTEM" // Exclude common system accounts
| summarize count() by EventID, Account, Computer, TargetUserName, MemberName // Adjust fields based on specific event details
| where count_ > 5 // Threshold for anomalous activity, adjust as needed

Splunk SPL

index=windows sourcetype=WinEventLog:Security (EventCode=4738 OR EventCode=4739 OR EventCode=4728 OR EventCode=4732 OR EventCode=4756 OR EventCode=4767) NOT Account="ANONYMOUS LOGON" NOT Account="NT AUTHORITY\\SYSTEM"
| stats count by EventCode, Account, Computer, TargetUserName, MemberName
| where count > 5

Sigma

title: CVE-2021-42287 Active Directory Privilege Escalation Attempt
status: experimental
description: Detects potential exploitation of CVE-2021-42287 by monitoring for anomalous Active Directory account or group modifications.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42287
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 4738 # A user account was changed
            - 4739 # Domain Policy was changed
            - 4728 # A member was added to a security-enabled global group
            - 4732 # A member was added to a security-enabled local group
            - 4756 # A member was added to a security-enabled universal group
            - 4767 # A user account was unlocked
    filter:
        AccountName:
            - 'ANONYMOUS LOGON'
            - 'NT AUTHORITY\\SYSTEM'
    condition: selection and not filter
    timeframe: 5m
    level: high

Elastic ES|QL

FROM logs-windows.security-*
| WHERE event.code IN (4738, 4739, 4728, 4732, 4756, 4767)
| WHERE NOT user.name IN ('ANONYMOUS LOGON', 'NT AUTHORITY\\SYSTEM')
| GROUP BY event.code, user.name, host.name, winlog.event_data.TargetUserName, winlog.event_data.MemberName
| AGG count = COUNT()
| WHERE count > 5