Windows Server 1903 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/windows-server-1903/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 18:15:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgComputer Account Changes via Anonymous Logon Detectedhttps://feed.craftedsignal.io/briefs/2024-01-anonymous-computer-change/Wed, 03 Jan 2024 18:15:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-anonymous-computer-change/Detection of Windows Event 4742 indicating a computer account change performed by an ANONYMOUS LOGON account, which is abnormal and could signify malicious activity, particularly Zerologon exploitation.This threat brief addresses the detection of anomalous computer account modifications within a Windows environment. The activity is flagged by monitoring Windows Security Event Log ID 4742 ("A computer account was changed") where the SubjectUserName is "ANONYMOUS LOGON". This event sequence is highly unusual because computer account changes should not originate from anonymous logons. It's often associated with exploitation attempts against CVE-2020-1472 (Zerologon), which allows attackers to reset the computer account password to an empty value. Successful exploitation can grant attackers domain administrator privileges. This poses a critical threat to organizations as it can lead to complete domain compromise. The detection focuses on the specific event sequence as a reliable indicator of potential Zerologon exploitation or related unauthorized activities.

Attack Chain

  1. Attacker gains initial access to the network (often internal).
  2. Attacker sends a series of Netlogon messages to the domain controller using the "ANONYMOUS LOGON" account.
  3. These messages exploit a cryptographic flaw (CVE-2020-1472) in the Netlogon protocol.
  4. The attacker successfully resets the domain controller's computer account password to an empty string.
  5. Windows Security Event 4742 is generated with SubjectUserName of "ANONYMOUS LOGON", indicating the computer account change.
  6. The attacker uses the now-empty password to authenticate to the domain controller as the computer account.
  7. Attacker obtains domain administrator privileges by leveraging the compromised computer account.
  8. Attacker performs malicious activities such as data exfiltration, ransomware deployment, or establishing persistent access.

Impact

Successful exploitation of this vulnerability and subsequent account takeover results in complete compromise of the Active Directory domain. This allows the attacker to steal sensitive data, deploy ransomware across the network, and gain persistent access to critical systems. This could result in millions of dollars in damages, regulatory fines, and reputational damage. The Zerologon vulnerability (CVE-2020-1472) has been widely exploited, and unpatched systems remain at high risk.

Recommendation

  • Deploy the Sigma rule "Detect Computer Changed with Anonymous Logon" to your SIEM and tune for your environment to detect Event ID 4742 with "ANONYMOUS LOGON" as SubjectUserName (see "rules" section).
  • Ensure that the "Audit Computer Account Management" sub-category within the Windows Audit Policy is enabled to generate Event ID 4742 (see "how_to_implement" section).
  • Prioritize patching systems vulnerable to CVE-2020-1472 to prevent exploitation via the Netlogon protocol. (see "cve" tag)
  • Review systems for evidence of CVE-2020-1472 exploitation attempts using references provided such as https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/.
]]>criticaladvisoryzerologonprivilege-escalationwindows