Skip to content
Threat Feed
Subscribe

Product

Windows Server 1903

1 brief RSS
critical advisory

Computer Account Changes via Anonymous Logon Detected

Detection of Windows Event 4742 indicating a computer account change performed by an ANONYMOUS LOGON account, which is abnormal and could signify malicious activity, particularly Zerologon exploitation.

PoC Splunk Enterprise +6 zerologon privilege-escalation windows
2r 1t 1c updated