A Zeek detection package for CVE-2020-1472, also known as Zerologon, which is a CVSS 10.0 privilege escalation vulnerability against the Netlogon protocol for Windows Server domain controllers.
By default, both notices are raised:
Zerologon_Attemptindicates the requisite number of login attempts were made within a short period of time.Zerologon_Password_Changeindicates the above, and a successful password change occurred.
By redefing notice_on_exploit_only to T in cluster.zeek, only
the Zerologon_Password_Change notice will be generated.
- Tested on Zeek versions
3.3.0-dev.53-debugand3.2.0, and Corelight Sensor v19. It should work with Zeek 3.0 and higher. - This package will run in both clustered and non-clustered environments.
- Developed against the included attack PCAPs.