Zerologon-style Netlogon machine account password reset on DC

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•6

Detects signs of Zerologon (CVE-2020-1472) exploitation by correlating Netlogon (MS-NRPC) authentication anomalies involving known exploitation tools/process names with subsequent machine-account password reset events (Event ID 4742) occurring on the same device within a short time window.