Windows NetLogon Secure Channel Connection Allowed for Vulnerable Client
Alerts on Windows NetLogon ETW events indicating an allowed secure channel connection (Event ID 5829).
- Product
- windows
- Service
- system
- Author
- NVISO (SigmaHQ), DRL 1.1
- Published
- 2020-09-15
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows System events where the NetLogon provider reports EventID 5829 indicating a secure channel connection was allowed. Attackers can leverage vulnerable Netlogon secure channel behavior to facilitate privilege escalation attempts, so spotting allowed connections is important for early investigation. It relies on Windows system telemetry from the NetLogon provider capturing EventID 5829 and the Provider_Name value.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows NetLogon Secure Channel Connection Allowed for Vulnerable Client
id: d37efaf2-cbac-4426-8656-0702a9a94481
status: test
description: This rule flags Windows System events where the NetLogon provider reports EventID 5829 indicating a secure channel connection was allowed. Attackers can leverage vulnerable Netlogon secure channel behavior to facilitate privilege escalation attempts, so spotting allowed connections is important for early investigation. It relies on Windows system telemetry from the NetLogon provider capturing EventID 5829 and the Provider_Name value.
references:
- https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/netlogon/win_system_vul_cve_2020_1472.yml
author: NVISO, Huntrule Team
date: 2020-09-15
modified: 2022-12-25
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: NetLogon
EventID: 5829
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a0cb7110-edf0-47a4-9177-541a4083128a
type: derived