Potential Zerologon (CVE-2020-1472) Exploitation

title: Potential Zerologon (CVE-2020-1472) Exploitation
id: dd7876d8-0f09-11eb-adc1-0242ac120002
status: test
description: Detects potential Netlogon Elevation of Privilege Vulnerability aka Zerologon (CVE-2020-1472)
references:
    - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
    - https://www.logpoint.com/en/blog/detecting-zerologon-vulnerability-in-logpoint/
author: Aleksandr Akhremchik, @aleqs4ndr, ocsd.community
date: 2020-10-15
modified: 2023-12-15
tags:
    - attack.privilege-escalation
    - attack.t1068
    - cve.2020-1472
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4742
        SubjectUserName: 'ANONYMOUS LOGON'
        TargetUserName|expand: '%DC-MACHINE-NAME%' # DC machine account name that ends with '$'
    filter_main:
        PasswordLastSet: '-'
    condition: selection and not filter_main
falsepositives:
    - Automatic DC computer account password change
    - Legitimate DC computer account password change
level: high