Zerologon Attack via Anonymous Logon Matching Local Computer Account

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•5

Detects potential exploitation of the Zerologon vulnerability (CVE-2020-1472) by correlating computer account password changes (Event ID 4742) with preceding anonymous or null SID logons (Event ID 4624) where the host identifier aligns. The rule identifies anomalous account modifications that occur within a short time window following an anonymous authentication request on the same host.