
title: Zerologon Exploitation Using Well-known Tools
author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community
date: 2020/10/13
description: This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472)
  vulnerability using mimikatz zerologon module or other exploits from machine with
  "kali" hostname.
detection:
  SELECTION_1:
    EventID:
    - '5805'
    - '5723'
  SELECTION_2:
  - kali
  - mimikatz
  condition: (SELECTION_1 and (SELECTION_2))
id: 18f37338-b9bd-4117-a039-280c81f7a596
level: critical
logsource:
  product: windows
  service: system
modified: 2021/05/30
references:
- https://www.secura.com/blog/zero-logon
- https://bi-zone.medium.com/hunting-for-zerologon-f65c61586382
status: stable
tags:
- attack.t1210
- attack.lateral_movement
ruletype: SIGMA
