Zerologon CVE-2020-1472 DC Privilege Escalation via Netlogon Zero-Credential Auth

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•7

Detects Zerologon exploitation attempts against domain controllers by monitoring for anomalous machine account password resets, execution of known exploitation tooling (e.g., zerologon_tester, secretsdump), and patterns of rapid Netlogon zero-credential authentication failures.