Zerologon CVE-2020-1472 unauthenticated NetrServerPasswordSet2 RPC call to DC

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•8

This rule detects unauthorized or unauthenticated attempts to call the NetrServerPasswordSet2 method on a Domain Controller via the MS-NRPC (Netlogon) interface, which is indicative of an exploitation attempt related to CVE-2020-1472 (Zerologon). This vulnerability allows an attacker to bypass authentication and reset a Domain Controller's computer account password, leading to full domain compromise.