
title: Possible Zerologon (CVE-2020-1472) Exploitation
author: Aleksandr Akhremchik, @aleqs4ndr, ocsd.community
date: 2020/10/15
description: Detects Netlogon Elevation of Privilege Vulnerability aka Zerologon (CVE-2020-1472)
detection:
  SELECTION_1:
    EventID: 4742
  SELECTION_2:
    SubjectUserName: ANONYMOUS LOGON
  SELECTION_3:
    TargetUserName: '%DC-MACHINE-NAME%'
  SELECTION_4:
    PasswordLastSet: '-'
  condition: ((SELECTION_1 and SELECTION_2 and SELECTION_3) and  not (SELECTION_4))
falsepositives:
- automatic DC computer account password change
- legitimate DC computer account password change
id: dd7876d8-0f09-11eb-adc1-0242ac120002
level: high
logsource:
  product: windows
  service: security
modified: 2021/07/07
references:
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
- https://www.logpoint.com/en/blog/detecting-zerologon-vulnerability-in-logpoint/
status: experimental
tags:
- attack.t1068
- attack.privilege_escalation
ruletype: SIGMA
