Zerologon CVE-2020-1472

[davisshannon]

Story, Zeek Detection, and macros for Zerologon CVE-2020-1472.

[josehelps]

Hey @davisshannon awesome work as always! Quick question for you, how noisy would it be to find these sequences of operations when looking at regular traffic for a domain controller, specifically NetrServerReqChallenge, NetrServerAuthenticate3,NetrServerPasswordSet2?

[guard-it]

I actually see multiple operations of the same type happening over the same connection during normal operations
In any case count a dc(operation) not make more sense as you want to check if the 3 operation types are happening

[davisshannon]

Are you seeing a count of 3 on a single UID in normal operation @guard-it? I'm trying to test and not seeing that happen outside of the exploit.

[guard-it]

@davisshannon yes lots of them. As far as I can see it is also being used by workstations that cycle their own machine account (schannel).
Certainly not the exploit as the preceding challenge is not "all zero"

[guard-it]

this is my current queryindex=bro sourcetype=bro_dce_rpc operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) | bin span=5m _time | stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount count as totalcount by _time,src_ip,dest_ip |search opscount=3 and authcount > 4

need to have the 3 types of operations in 5 minutes and more that 4 auth attempts ( I know they could be right after the first one) ... but i have upto 3 legit auth attempts in my install base

[davisshannon]

Thanks @guard-it, testing this out. Initially it's not picking up the exploit in my environment. I'm going to tweak it a bit to see if I can pick it up.

[davisshannon]

I've added a check on the passcount to your search @guard-it, that way we see the actual password reset attempts being returned as well. I've put the ChallengeReq back in as well since that contributes to the totalcount. Thanks for helping out!

index=zeek sourcetype=bro:rpc:json operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3)
| bin span=5m _time
| stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount count as totalcount by _time,src_ip,dest_ip
| search opscount=3 authcount>4 passcount>0

[josehelps]

@davisshannon closing this since I migrated the detection to #680 to commit all the detection we have written so far. Thank you!