{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3omicrosoftwindows_server_1903/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*","cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_20h2:-:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*","cpe:2.3:a:synology:directory_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.5,"id":"CVE-2020-1472"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-CANCIUCOSTIN-CVE-2020-1472\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Splunk Enterprise","Splunk Enterprise Security","Splunk Cloud","Windows Server 1903","Windows Server 1909","Windows Server 2004","Windows Server 2008"],"_cs_severities":["critical"],"_cs_tags":["zerologon","privilege-escalation","windows"],"_cs_type":"advisory","_cs_vendors":["Microsoft","Splunk"],"content_html":"\u003cp\u003eThis threat brief addresses the detection of anomalous computer account modifications within a Windows environment. The activity is flagged by monitoring Windows Security Event Log ID 4742 (\u0026quot;A computer account was changed\u0026quot;) where the SubjectUserName is \u0026quot;ANONYMOUS LOGON\u0026quot;. This event sequence is highly unusual because computer account changes should not originate from anonymous logons. It's often associated with exploitation attempts against CVE-2020-1472 (Zerologon), which allows attackers to reset the computer account password to an empty value. Successful exploitation can grant attackers domain administrator privileges. This poses a critical threat to organizations as it can lead to complete domain compromise. The detection focuses on the specific event sequence as a reliable indicator of potential Zerologon exploitation or related unauthorized activities.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to the network (often internal).\u003c/li\u003e\n\u003cli\u003eAttacker sends a series of Netlogon messages to the domain controller using the \u0026quot;ANONYMOUS LOGON\u0026quot; account.\u003c/li\u003e\n\u003cli\u003eThese messages exploit a cryptographic flaw (CVE-2020-1472) in the Netlogon protocol.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully resets the domain controller's computer account password to an empty string.\u003c/li\u003e\n\u003cli\u003eWindows Security Event 4742 is generated with SubjectUserName of \u0026quot;ANONYMOUS LOGON\u0026quot;, indicating the computer account change.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the now-empty password to authenticate to the domain controller as the computer account.\u003c/li\u003e\n\u003cli\u003eAttacker obtains domain administrator privileges by leveraging the compromised computer account.\u003c/li\u003e\n\u003cli\u003eAttacker performs malicious activities such as data exfiltration, ransomware deployment, or establishing persistent access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability and subsequent account takeover results in complete compromise of the Active Directory domain. This allows the attacker to steal sensitive data, deploy ransomware across the network, and gain persistent access to critical systems. This could result in millions of dollars in damages, regulatory fines, and reputational damage. The Zerologon vulnerability (CVE-2020-1472) has been widely exploited, and unpatched systems remain at high risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Computer Changed with Anonymous Logon\u0026quot; to your SIEM and tune for your environment to detect Event ID 4742 with \u0026quot;ANONYMOUS LOGON\u0026quot; as SubjectUserName (see \u0026quot;rules\u0026quot; section).\u003c/li\u003e\n\u003cli\u003eEnsure that the \u0026quot;Audit Computer Account Management\u0026quot; sub-category within the Windows Audit Policy is enabled to generate Event ID 4742 (see \u0026quot;how_to_implement\u0026quot; section).\u003c/li\u003e\n\u003cli\u003ePrioritize patching systems vulnerable to CVE-2020-1472 to prevent exploitation via the Netlogon protocol. (see \u0026quot;cve\u0026quot; tag)\u003c/li\u003e\n\u003cli\u003eReview systems for evidence of CVE-2020-1472 exploitation attempts using references provided such as \u003ca href=\"https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/\"\u003ehttps://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-31T17:06:11Z","date_published":"2024-01-03T18:15:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-anonymous-computer-change/","summary":"Detection of Windows Event 4742 indicating a computer account change performed by an ANONYMOUS LOGON account, which is abnormal and could signify malicious activity, particularly Zerologon exploitation.","title":"Computer Account Changes via Anonymous Logon Detected","url":"https://feed.craftedsignal.io/briefs/2024-01-anonymous-computer-change/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}