27/12/2021 update: From version 2.166, Microsoft Defender for Identity can now natively detect this vulnerability. This version includes a new security alert: Suspicious modification of a sAMNameAcco...
Updated Jan 12, 2022
Version 2.0
Blog Post
Preventing domain users from joining/creating machine account could eliminate to attack from the beginning. This privilege should be restricted to authorized accounts only (i.e. IT)
https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain
https://blog.compass-security.com/2020/03/domain-join-computers-the-proper-way/