Semperis DSP Zerologon vulnerability

Back


Id	85c1f9e4-6f14-46bf-82d5-dbe495b92aab
Rulename	Semperis DSP Zerologon vulnerability
Description	This indicator looks for security vulnerability to CVE-2020-1472, which was patched by Microsoft in August 2020. Without this patch, an unauthenticated attacker can exploit CVE-2020-1472 to elevate their privileges and get administrative access on the domain.
Severity	Medium
Tactics	PrivilegeEscalation
Techniques	T1068
Required data connectors	SemperisDSP
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_ZerologonVulnerability.yaml
Version	2.0.7
Arm template	85c1f9e4-6f14-46bf-82d5-dbe495b92aab.json

KQL

dsp_parser
| where EventID == 9212
| where SecurityIndicatorName == "Zerologon vulnerability"
| extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))

YAML

tactics:
- PrivilegeEscalation
triggerOperator: gt
requiredDataConnectors:
- connectorId: SemperisDSP
  dataTypes:
  - dsp_parser
relevantTechniques:
- T1068
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: DnsDomain
  entityType: Host
id: 85c1f9e4-6f14-46bf-82d5-dbe495b92aab
queryPeriod: 1h
name: Semperis DSP Zerologon vulnerability
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_ZerologonVulnerability.yaml
queryFrequency: 1h
description: |
    'This indicator looks for security vulnerability to CVE-2020-1472, which was patched by Microsoft in August 2020. Without this patch, an unauthenticated attacker can exploit CVE-2020-1472 to elevate their privileges and get administrative access on the domain.'
version: 2.0.7
query: |
  dsp_parser
  | where EventID == 9212
  | where SecurityIndicatorName == "Zerologon vulnerability"
  | extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))  
triggerThreshold: 0
severity: Medium
status: Available
kind: Scheduled

ARM