Vulnerable Netlogon Secure Channel Connection Allowed

calendar Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548  ·
Share on: linkedin copy

Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.

Sigma rule (View on GitHub)

 1title: Vulnerable Netlogon Secure Channel Connection Allowed
 2id: a0cb7110-edf0-47a4-9177-541a4083128a
 3status: test
 4description: Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.
 5references:
 6    - https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc
 7author: NVISO
 8date: 2020-09-15
 9modified: 2022-12-25
10tags:
11    - attack.defense-evasion
12    - attack.privilege-escalation
13    - attack.t1548
14logsource:
15    product: windows
16    service: system
17detection:
18    selection:
19        Provider_Name: NetLogon  # Active Directory: NetLogon ETW GUID {F33959B4-DBEC-11D2-895B-00C04F79AB69}
20        EventID: 5829
21    condition: selection
22falsepositives:
23    - Unknown
24fields:
25    - SAMAccountName
26level: high

References

Related rules

to-top