Zerologon Exploitation Using Well-known Tools

 1title: Zerologon Exploitation Using Well-known Tools
 2id: 18f37338-b9bd-4117-a039-280c81f7a596
 3status: stable
 4description: This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
 5references:
 6    - https://www.secura.com/blog/zero-logon
 7    - https://bi-zone.medium.com/hunting-for-zerologon-f65c61586382
 8author: 'Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community'
 9date: 2020-10-13
10modified: 2021-05-30
11tags:
12    - attack.t1210
13    - attack.lateral-movement
14logsource:
15    service: system
16    product: windows
17detection:
18    selection:
19        EventID:
20            - 5805
21            - 5723
22    keywords:
23        - kali
24        - mimikatz
25    condition: selection and keywords
26level: critical

References

• Zerologon: instantly become domain admin by subverting Netlogon cryptography (CVE-2020-1472) | Secura - Take Control of Your Digital Security

  

  Secura is your independent, specialised advisor taking care of your digital security needs. We bundle our services into a complete portfolio that enables you to be proactive and in control of your digital security. Take control of your digital security.

  
  Read More

• Hunting for Zerologon

  

  By Demyan Sokolin (@_drd0c), Alexander Bolshakov (@spacepatcher), Ilyas Igisinov (@ph7ntom), Vadim Khrykov(@BlackMatter23)

  
  Read More

Related rules

• Apache Threading Error
• Audit CVE Event
• OMIGOD HTTP No Authentication RCE
• Possible Exploitation of Exchange RCE CVE-2021-42321
• Suspicious SysAidServer Child