udm netlogon crash udm context

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•4•0•6

Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.