Zerologon CVE-2020-1472 Exploitation via Impacket zerologon tools

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects execution of tools and scripts known for exploiting the Zerologon (CVE-2020-1472) vulnerability, including zerologon_tester.py, zerologon.py, and Impacket-based Netlogon authentication abuse. The rule monitors command-line activity for these indicators, excluding processes signed by Microsoft.