Semperis DSP Zerologon vulnerability

Back


Id	85c1f9e4-6f14-46bf-82d5-dbe495b92aab
Rulename	Semperis DSP Zerologon vulnerability
Description	This indicator looks for security vulnerability to CVE-2020-1472, which was patched by Microsoft in August 2020. Without this patch, an unauthenticated attacker can exploit CVE-2020-1472 to elevate their privileges and get administrative access on the domain.
Severity	Medium
Tactics	PrivilegeEscalation
Techniques	T1068
Required data connectors	SemperisDSP
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_ZerologonVulnerability.yaml
Version	2.0.7
Arm template	85c1f9e4-6f14-46bf-82d5-dbe495b92aab.json

KQL

dsp_parser
| where EventID == 9212
| where SecurityIndicatorName == "Zerologon vulnerability"
| extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))

YAML

relevantTechniques:
- T1068
name: Semperis DSP Zerologon vulnerability
triggerThreshold: 0
tactics:
- PrivilegeEscalation
severity: Medium
id: 85c1f9e4-6f14-46bf-82d5-dbe495b92aab
status: Available
requiredDataConnectors:
- dataTypes:
  - dsp_parser
  connectorId: SemperisDSP
kind: Scheduled
query: |
  dsp_parser
  | where EventID == 9212
  | where SecurityIndicatorName == "Zerologon vulnerability"
  | extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))  
description: |
    'This indicator looks for security vulnerability to CVE-2020-1472, which was patched by Microsoft in August 2020. Without this patch, an unauthenticated attacker can exploit CVE-2020-1472 to elevate their privileges and get administrative access on the domain.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_ZerologonVulnerability.yaml
triggerOperator: gt
queryPeriod: 1h
queryFrequency: 1h
version: 2.0.7
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: DnsDomain
    identifier: DnsDomain

ARM