netlogon | Detection.FYI

Vulnerable Netlogon Secure Channel Connection Allowed

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.

Read More
Zerologon Exploitation Using Well-known Tools

Aug 12, 2024 · attack.t1210 attack.lateral-movement ·
Share on:

This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.

Read More