Vulnerable Netlogon Secure Channel Connection Allowed (CVE-2020-1472)

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•24

Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472, also known as Zerologon. This vulnerability allows an unauthenticated attacker to gain domain administrator privileges.