Detection of Windows Event 4742 indicating a computer account change performed by an ANONYMOUS LOGON account, which is abnormal and could signify malicious activity, particularly Zerologon exploitation.
PoC
Splunk Enterprise +6
zerologon
privilege-escalation
windows
2r
1t
1c
updated