Zerologon CVE-2020-1472 Exploitation via Impacket zerologon_tester

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•9

Detects exploitation attempts of the Zerologon (CVE-2020-1472) vulnerability using Impacket tools. The rule monitors for unauthorized machine account password resets via Netlogon, execution of common exploitation scripts like zerologon_tester.py or secretsdump.py, and suspicious NTLM anonymous authentication patterns often associated with the exploit.