Zerologon Exploitation Using Well-known Tools

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•36

This rule detects attempts to exploit the Zerologon vulnerability (CVE-2020-1472) using tools like Mimikatz or other exploits originating from a machine with 'kali' in its hostname. It specifically looks for Windows System event IDs 5805 or 5723 in conjunction with the keywords 'kali' or 'mimikatz'.