ZeroLogon Exploitation Rule set

[code_heaven]

Hello,

Has anyone been able to come up with a custom rule to detect ZeroLogon vulnerability exploitation? I will like to here from anyone that has created a rule.

cheers!!!

[ihsanjhakeem · Accepted solution]

you can create something like this

Rule is true when

ServiceWarning.ProviderSID

is equal to *5828

OR

 ServiceWarning.ProviderSID

is equal to  *5827

OR

 ServiceWarning.ProviderSID

is equal to *5829

[ihsanjhakeem · Accepted solution]

you can create something like this

Rule is true when

ServiceWarning.ProviderSID

is equal to *5828

OR

 ServiceWarning.ProviderSID

is equal to  *5827

OR

 ServiceWarning.ProviderSID

is equal to *5829

[code_heaven · Accepted solution]

Thanks. 

Does Solarwinds assist customers in creating custom rules like this, especially when new threats appears in  the InfoSec space? ? e.g. Does Solarwinds have USE CASE like other vendors? 

[ihsanjhakeem]

This will have to be created manually or custom rules. I don't think solarwind SEM have constant updates for new rules. 

You can call them for support to create a rule for you.

[ihsanjhakeem]

Check first if you have any events for this before creating a rule. 

Once you find the event you can create easily 

Here is a script to check 

https://support.microsoft.com/en-us/help/4557233/script-to-help-in-monitoring-event-ids-related-to-c...

Please read this 

https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channe....