[New Rule] Potential ResetNightmare UPN Account Takeover (CVE-2026-27912) by w0rk3r · Pull Request #6679 · elastic/detection-rules

w0rk3r · 2026-08-19T20:19:54Z

Issues

Part of https://github.com/elastic/ia-trade-team/issues/1061

Summary

Identifies a User Principal Name (UPN) being set to another account's sAMAccountName, followed by a password change for that other account. This pattern may indicate ResetNightmare (CVE-2026-27912), which allows an attacker who can write a UPN to reset another account's password and take over that account. Targeting a privileged identity can escalate a standard domain user to Domain Admin or equivalent control of the domain.

Data for the testing can be found on the team stack.

Example Data

Resulting event JSON

{
  "@timestamp": "2026-08-18T06:46:02.978-03:00",
  "event.ingested": "2026-08-18T06:46:11.000-03:00",
  "event.code": "4723",
  "event.outcome": "success",
  "Esql.stage": "password_change",
  "Esql.victim_sid": "S-1-5-21-2038103339-2155116624-3331879844-1117",
  "Esql.assignment_times": "2026-08-18T06:46:02.805-03:00",
  "Esql.computer_name": "meereen.essos.local",
  "Esql.actor_sid": "S-1-5-21-2038103339-2155116624-3331879844-1115",
  "Esql.victim_name": "missandei",
  "Esql.assignment_span_ms": 173,
  "Esql.assignment_time": "2026-08-18T06:46:02.805-03:00",
  "host.id": "78dfb2cd-7fe7-4362-bdda-31953b32e9b3",
  "host.name": "meereen",
  "winlog.computer_name": "meereen.essos.local",
  "winlog.event_data.SubjectUserSid": "S-1-5-21-2038103339-2155116624-3331879844-1115",
  "winlog.event_data.SubjectUserName": "khal.drogo",
  "winlog.event_data.SubjectDomainName": "ESSOS",
  "winlog.event_data.TargetSid": "S-1-5-21-2038103339-2155116624-3331879844-1117",
  "winlog.event_data.TargetUserName": "missandei",
  "winlog.event_data.TargetDomainName": "ESSOS",
  "winlog.record_id": "3117948",
  "_id": "AaAUQxeCu9npfSmgWh68",
  "_index": ".ds-logs-system.security-default-2026.07.22-000024",
  "_version": 1
}

)

elastic-vault-github-plugin-prod · 2026-08-19T20:20:24Z

⛔️ Test failed

Results

❌ Potential ResetNightmare UPN Account Takeover (CVE-2026-27912) (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

Copilot

Pull request overview

Adds a new Windows/Active Directory detection rule to identify potential ResetNightmare (CVE-2026-27912) abuse by correlating a UPN assignment to another account’s sAMAccountName with a subsequent password change for that account.

Changes:

Introduces a new ES|QL rule correlating Security Event IDs 4738 (UPN set) and 4723 (password change) within a short time window.
Adds supporting rule metadata (references, ATT&CK mapping, investigation fields, setup guidance) for triage and operational use.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+tags = [
+    "Domain: Identity",
+    "OS: Windows",
+    "Use Case: Threat Detection",
+    "Tactic: Privilege Escalation",
+    "Tactic: Persistence",
+    "Use Case: Active Directory Monitoring",
+    "Use Case: Vulnerability",
+    "Data Source: Active Directory",
+    "Data Source: Windows Security Event Logs",
+]


+  | WHERE Esql.victim_name IS NOT NULL AND
+      Esql.actor_sid IS NOT NULL AND
+      Esql.computer_name IS NOT NULL AND
+      Esql.actor_sid != Esql.victim_sid
+)


terrancedejesus · 2026-08-25T13:39:56Z

+standard domain user to Domain Admin or equivalent control of the domain.
+"""
+from = "now-9m"
+interval = "5m"


Suggested change

interval = "5m"

default is 5m

terrancedejesus · 2026-08-25T13:40:23Z

+    "Use Case: Active Directory Monitoring",
+    "Use Case: Vulnerability",
+    "Data Source: Active Directory",
+    "Data Source: Windows Security Event Logs",


Suggested change

"Data Source: Windows Security Event Logs",

"Data Source: Windows Security Event Logs",

"Vuln: CVE-2026-27912",

terrancedejesus · 2026-08-25T13:41:54Z

+| KEEP
+    @timestamp,
+    event.ingested,
+    event.code,
+    event.outcome,
+    Esql.*,
+    host.id,
+    host.name,
+    winlog.computer_name,
+    winlog.event_data.SubjectUserSid,
+    winlog.event_data.SubjectUserName,
+    winlog.event_data.SubjectDomainName,
+    winlog.event_data.TargetSid,
+    winlog.event_data.TargetUserName,
+    winlog.event_data.TargetDomainName,
+    winlog.record_id,
+    _id,
+    _index,
+    _version


Suggested change

| KEEP

@timestamp,

event.ingested,

event.code,

event.outcome,

Esql.*,

host.id,

host.name,

winlog.computer_name,

winlog.event_data.SubjectUserSid,

winlog.event_data.SubjectUserName,

winlog.event_data.SubjectDomainName,

winlog.event_data.TargetSid,

winlog.event_data.TargetUserName,

winlog.event_data.TargetDomainName,

winlog.record_id,

_id,

_index,

_version

| KEEP

@timestamp,

event.*

Esql.*,

host.*

winlog.*

_id,

_index,

_version

nit

terrancedejesus · 2026-08-25T13:51:06Z

+UPN to reset another account's password and take over that account. Targeting a privileged identity can escalate a
+standard domain user to Domain Admin or equivalent control of the domain.
+"""
+from = "now-9m"


Can we safely increase the lookback window?
Could wait 10 minutes, then clear the UPN and continue to the password reset which would bypass the rule.

terrancedejesus

Have we investigated the use of `5136? Current rule seems to work pretty well! Great work!

ref: https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/
ref: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5136

Aegrah

The logic looks good to me; but we may want a few more eyes on this since it's complicated.

Aegrah · 2026-09-09T11:08:52Z

+Setup instructions: https://ela.st/audit-user-account-management
+"""
+severity = "medium"
+tags = [


The required taxonomy tags Platform: Windows and Rule Type: ESQL are missing. Adding both here could keep this rule discoverable and compliant with the rule-tag taxonomy.

Aegrah · 2026-09-09T11:08:52Z

+  /* 4738 TargetSid is the UPN object (actor); UserPrincipalName is the victim SAM. */
+  | EVAL Esql.stage = "upn_assignment",
+      Esql.actor_sid = winlog.event_data.TargetSid,
+      Esql.victim_name = TO_LOWER(winlog.event_data.UserPrincipalName),


Nit: we generally used the format Esql.field_name + operation (if relevant); may want to update these to the standardized format.

[New Rule] Potential ResetNightmare UPN Account Takeover (CVE-2026-27912

e2b76f2

)

w0rk3r requested review from Aegrah, Mikaayenson, Samirbous, bryans3c, django-88, eric-forte-elastic and terrancedejesus August 19, 2026 20:19

w0rk3r self-assigned this Aug 19, 2026

Copilot AI lite review requested due to automatic review settings August 19, 2026 20:19

w0rk3r added Rule: New Proposal for new rule OS: Windows windows related rules Domain: Endpoint backport: auto labels Aug 19, 2026

Copilot started reviewing on behalf of w0rk3r August 19, 2026 20:20 View session

Copilot AI reviewed Aug 19, 2026

View reviewed changes

terrancedejesus reviewed Aug 25, 2026

View reviewed changes

terrancedejesus approved these changes Aug 25, 2026

View reviewed changes

Aegrah approved these changes Sep 9, 2026

View reviewed changes

Navigation Menu

Uh oh!

[New Rule] Potential ResetNightmare UPN Account Takeover (CVE-2026-27912) - #6679

[New Rule] Potential ResetNightmare UPN Account Takeover (CVE-2026-27912)#6679
w0rk3r wants to merge 1 commit into
mainfrom
resetnightmare

w0rk3r commented Aug 19, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Aug 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

terrancedejesus Aug 25, 2026

Uh oh!

terrancedejesus Aug 25, 2026

Uh oh!

terrancedejesus Aug 25, 2026

Uh oh!

terrancedejesus Aug 25, 2026

Uh oh!

terrancedejesus left a comment

Uh oh!

Aegrah left a comment

Uh oh!

Aegrah Sep 9, 2026

Uh oh!

Aegrah Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	"Data Source: Windows Security Event Logs",
	"Data Source: Windows Security Event Logs",
	"Vuln: CVE-2026-27912",

Uh oh!

Conversation

w0rk3r commented Aug 19, 2026

Issues

Summary

Example Data

Uh oh!

elastic-vault-github-plugin-prod Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

terrancedejesus Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

terrancedejesus Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

terrancedejesus Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

terrancedejesus Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

terrancedejesus left a comment

Choose a reason for hiding this comment

Uh oh!

Aegrah left a comment

Choose a reason for hiding this comment

Uh oh!

Aegrah Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

Aegrah Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

elastic-vault-github-plugin-prod Bot commented Aug 19, 2026 •

edited

Loading