Windows Zerologon exploitation attempt from Kali host using mimikatz

Identifies Windows Zerologon exploitation attempts tied to Kali-hosted activity and mimikatz-related keywords.

FreeUnreviewedSigmacriticalv1

windows-zerologon-exploitation-attempt-from-kali-host-using-mimikatz-18f37338

title: Windows Zerologon exploitation attempt from Kali host using mimikatz
id: ada1319a-15e6-44e3-abd4-802867314147
status: stable
description: This rule flags Windows system events that coincide with attempts to exploit Zerologon, indicated by the presence of the keywords "kali" and "mimikatz" alongside relevant event activity. Attackers may use automated tooling or well-known exploit modules to target vulnerable authentication components for lateral movement. The detection relies on Windows system telemetry using EventID 5805 and 5723, and matches keyword occurrences for "kali" and "mimikatz" within the event context.
references:
  - https://www.secura.com/blog/zero-logon
  - https://bi-zone.medium.com/hunting-for-zerologon-f65c61586382
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/netlogon/win_system_possible_zerologon_exploitation_using_wellknown_tools.yml
author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2021-05-30
tags:
  - attack.t1210
  - attack.lateral-movement
logsource:
  service: system
  product: windows
detection:
  selection:
    EventID:
      - 5805
      - 5723
  keywords:
    - kali
    - mimikatz
  condition: selection and keywords
level: critical
license: DRL-1.1
related:
  - id: 18f37338-b9bd-4117-a039-280c81f7a596
    type: derived

What it detects

This rule flags Windows system events that coincide with attempts to exploit Zerologon, indicated by the presence of the keywords "kali" and "mimikatz" alongside relevant event activity. Attackers may use automated tooling or well-known exploit modules to target vulnerable authentication components for lateral movement. The detection relies on Windows system telemetry using EventID 5805 and 5723, and matches keyword occurrences for "kali" and "mimikatz" within the event context.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.