Zerologon CVE-2020-1472 DC Privilege Escalation via Netlogon Zero-Credential

Ibrahim Saud@tektrix

•updated Jun 25, 2026•2•0•7

Detects potential exploitation of the Zerologon vulnerability (CVE-2020-1472) by identifying a high volume of Netlogon authentication requests followed by a successful login by a Domain Admin, indicating a machine account password reset attack.