Remote domain controller password reset (Zerologon)

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to exploit the Zerologon vulnerabiliy which triggers, bsides others things, a password reset on a domain controller.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1210` Exploitation of Remote Services

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4724: An attempt was made to reset an account's password.
Security-Auditing	Event ID 4742: A computer account was changed.

Rule body

title: Remote domain controller password reset (Zerologon) 
description: Detects scenarios where an attacker attempts to exploit the Zerologon vulnerabiliy which triggers, bsides others things, a password reset on a domain controller.
references:
- https://thedfirreport.com/2022/11/14/bumblebee-zeros-in-on-meterpreter/
- https://stealthbits.com/blog/zerologon-from-zero-to-hero-part-2/
- https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/
- https://blog.nviso.eu/2020/09/17/sentinel-query-detect-zerologon-cve-2020-1472/
- https://blog.zsec.uk/zerologon-attacking-defending/
tags:
- attack.lateral_movement
- attack.t1210 # Exploitation of Remote Services 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  domain_controller:
    Computer: '%domain_controllers%'

  selection_account_changed:
    EventID: 4742 # computer account changed
    TargetUserName|endswith: '$' # focus only on computer accounts

  filter_account_changed:
    PasswordLastSet: '-'
  
  selection_reset:
    EventID: 4724

  condition: domain_controller and (selection_reset or (selection_account_changed and not filter_account_changed) )
falsepositives:
- None 
level: high

Stages and Predicates

Stage 0: `condition`

domain_controller and (selection_reset or (selection_account_changed and not filter_account_changed) )

Stage 1: `domain_controller`

domain_controller:
  Computer: '%domain_controllers%'

Stage 2: `selection_reset`

selection_reset:
  EventID: 4724

Stage 3: `selection_account_changed`

selection_account_changed:
  EventID: 4742
  TargetUserName|endswith: '$'

Stage 4: `not filter_account_changed`

filter_account_changed:
  PasswordLastSet: '-'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`PasswordLastSet`	eq	`-`	`excludes:PasswordLastSet` `field:"PasswordLastSet" value:"-"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Computer`	eq	`%domain_controllers%` corpus 3 (sigma 3)	`field:"Computer" kind:eq value:"%domain_controllers%"`
`TargetUserName`	ends_with	`$` corpus 11 (sigma 7, splunk 2, kusto 2)	`field:"TargetUserName" kind:ends_with value:"$"`