Analytics Story: Detect Zerologon Attack

Date: 2020-09-18 ID: 5d14a962-569e-4578-939f-f386feb63ce4 Author: Rod Soto, Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk Product: Splunk Enterprise Security

Description

Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier.

Why it matters

This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Detect Mimikatz Using Loaded Images	LSASS Memory, OS Credential Dumping	TTP
Detect Computer Changed with Anonymous Account	Exploitation of Remote Services	Hunting
Detect Credential Dumping through LSASS access	LSASS Memory, OS Credential Dumping	TTP
Windows Possible Credential Dumping	LSASS Memory, OS Credential Dumping	TTP
Detect Zerologon via Zeek	Exploit Public-Facing Application	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Sysmon EventID 10	Windows	`xmlwineventlog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 7	Windows	`xmlwineventlog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4624	Windows	`xmlwineventlog`	`XmlWinEventLog:Security`
Windows Event Log Security 4742	Windows	`xmlwineventlog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 1