Name:Detect Zerologon via Zeek id:bf7a06ec-f703-11ea-adc1-0242ac120002 version:3 date:2024-10-17 author:Shannon Davis, Splunk status:experimental type:TTP Description:The following analytic detects attempts to exploit the Zerologon CVE-2020-1472 vulnerability via Zeek RPC. It leverages Zeek DCE-RPC data to identify specific operations: NetrServerPasswordSet2, NetrServerReqChallenge, and NetrServerAuthenticate3. This activity is significant because it indicates an attempt to gain unauthorized access to a domain controller, potentially leading to a complete takeover of an organization's IT infrastructure. If confirmed malicious, the impact could be severe, including data theft, ransomware deployment, or other devastating outcomes. Immediate investigation of the identified IP addresses and RPC operations is crucial. Data_source:
search:`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) | bin span=5m _time | stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount count as totalcount by _time,src_ip,dest_ip | search opscount=3 authcount>4 passcount>0 | search `detect_zerologon_via_zeek_filter`
how_to_implement:You must be ingesting Zeek DCE-RPC data into Splunk. Zeek data should also be getting ingested in JSON format. We are detecting when all three RPC operations (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) are splunk_security_essentials_app via bro:rpc:json. These three operations are then correlated on the Zeek UID field. known_false_positives:unknown References: -https://www.secura.com/blog/zero-logon -https://github.com/SecuraBV/CVE-2020-1472 -https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 -https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a drilldown_searches:
: tags: analytic_story: - 'Detect Zerologon Attack' - 'Rhysida Ransomware' asset_type:Network confidence:50 cve: - 'CVE-2020-1472' impact:50 message:tbd mitre_attack_id: - 'T1190' observable: name:'dest' type:'Hostname' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'operation' risk_score:25 security_domain:network
