Zerologon CVE-2020-1472 Exploitation via Impacket secretsdump and zerologon_tester

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects exploitation attempts of the Zerologon vulnerability (CVE-2020-1472) by monitoring for specific process executions related to Impacket tools (secretsdump, zerologon_tester), suspicious domain controller machine account password resets via Windows Event ID 4742, and high-frequency Netlogon authentication failures (Event ID 4776) typical of the zero-length client challenge brute force attack.