Detection: Windows AD User Suspicious UPN Change

Updated Date: 2026-09-23 ID: 81324b8b-46c0-4ca3-b9a1-d33638f21021 Author: Raven Tait, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738. This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account. The KDC then resolves a ptype=10 (NT-ENTERPRISE) Kerberos pre-authentication request against the spoofed UPN, issuing a kadmin/changepw TGT that can be used to change the target account's password via kpasswd (port 464). Event 4738 is generated when a user account attribute is changed. This analytic filters to events where the SubjectUserSid equals the TargetSid (self-modification), the new UPN value is not a standard UPN (no @ sign), and the value is not a Windows placeholder. A non-UPN value set on one's own account is anomalous and has no legitimate administrative use case.

Search

 1`wineventlog_security`
 2EventCode=4738
 3UserPrincipalName="*"
 4NOT UserPrincipalName IN (
 5    "-",
 6    "",
 7    "*@*",
 8    "%%1793"
 9)
10NOT SubjectUserSid IN (
11    "S-1-5-18",
12    "S-1-5-7"
13)
14NOT SubjectUserName IN (
15    "ANONYMOUS*",
16    "NT AUTHORITY*"
17)
18
19
20| where SubjectUserSid=TargetSid
21
22
23| stats count min(_time) as firstTime
24              max(_time) as lastTime
25
26  by dest SubjectUserName SubjectUserSid TargetUserName TargetSid UserPrincipalName
27
28
29| `security_content_ctime(firstTime)`
30
31| `security_content_ctime(lastTime)`
32
33| `windows_ad_user_suspicious_upn_change_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log Security 4738	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Security'`

Macros Used

Name	Value
wineventlog_security	`eventtype="wineventlog_security" OR Channel="security" OR source="XmlWinEventLog:Security" OR source="WinEventLog:Security"`
windows_ad_user_suspicious_upn_change_filter	`search *`

windows_ad_user_suspicious_upn_change_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1078.002	Domain Accounts	Initial Access

Installation

Delivery

Exploitation

DE.CM

CIS 10

CVE

CVE-2026-27912

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting User Account Management within Account Management needs to be enabled.

Known False Positives

Administrators or identity management tools may legitimately set a UPN that does not contain an @ sign during account provisioning or migration workflows. Investigate the SubjectUserName and context to confirm.

Associated Analytic Story

Active Directory Kerberos Attacks

Finding

Title	Entity Field	Entity Type	Risk Score
User [$SubjectUserName$] set their UPN to [$UserPrincipalName$] on $dest$	SubjectUserName	user	50

Threat Objects

Field	Type
SubjectUserName	user

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1