udm netlogon crash udm context

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•1•0•8

Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.