Zerologon CVE-2020-1472 Netlogon zero-credential DC privilege escalation

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects anomalous activities associated with the Zerologon (CVE-2020-1472) vulnerability. The rule identifies suspicious machine account password changes, NTLM authentication from potentially untrusted subnets or unconfigured workstations, and privilege escalation indicators occurring on domain controllers.