ZeroLogon PoC Execution Detection (CVE-2020-1472)

SigmaHQ Detections@sigmaHQ

•updated Apr 17, 2025•1•0•39

This rule detects the execution of known Proof-of-Concept (PoC) executables for the ZeroLogon vulnerability (CVE-2020-1472). It specifically looks for `cmd.exe` spawning executables named `cool.exe` or `zero.exe` with command-line arguments indicating administrative context and execution flags. Additionally, it identifies subsequent actions such as `taskkill` commands or `powershell` execution, which are common post-exploitation activities after successful ZeroLogon exploitation.