Detection rules › Sigma
Remote domain controller password reset (Zerologon)
Detects scenarios where an attacker attempts to exploit the Zerologon vulnerabiliy which triggers, bsides others things, a password reset on a domain controller.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1210 Exploitation of Remote Services |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4724 | An attempt was made to reset an account's password. |
| Security-Auditing | Event ID 4742 | A computer account was changed. |
Rule body yaml
title: Remote domain controller password reset (Zerologon)
description: Detects scenarios where an attacker attempts to exploit the Zerologon vulnerabiliy which triggers, bsides others things, a password reset on a domain controller.
references:
- https://thedfirreport.com/2022/11/14/bumblebee-zeros-in-on-meterpreter/
- https://stealthbits.com/blog/zerologon-from-zero-to-hero-part-2/
- https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/
- https://blog.nviso.eu/2020/09/17/sentinel-query-detect-zerologon-cve-2020-1472/
- https://blog.zsec.uk/zerologon-attacking-defending/
tags:
- attack.lateral_movement
- attack.t1210 # Exploitation of Remote Services
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
domain_controller:
Computer: '%domain_controllers%'
selection_account_changed:
EventID: 4742 # computer account changed
TargetUserName|endswith: '$' # focus only on computer accounts
filter_account_changed:
PasswordLastSet: '-'
selection_reset:
EventID: 4724
condition: domain_controller and (selection_reset or (selection_account_changed and not filter_account_changed) )
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
domain_controller and (selection_reset or (selection_account_changed and not filter_account_changed) )Stage 1: domain_controller
domain_controller:
Computer: '%domain_controllers%'
Stage 2: selection_reset
selection_reset:
EventID: 4724
Stage 3: selection_account_changed
selection_account_changed:
EventID: 4742
TargetUserName|endswith: '$'
Stage 4: not filter_account_changed
filter_account_changed:
PasswordLastSet: '-'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
PasswordLastSet | eq | - |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Computer | eq |
|
TargetUserName | ends_with |
|