Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host

Identifies Windows Zerologon exploitation attempts tied to Kali-hosted activity and mimikatz-related keywords.

FreeReviewedSigma · Critical · v2

Product: windows
Service: system
Author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-13
Updated: 2026-07-31

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1210Exploitation of Remote Services
Collection
C2
Exfiltration
Impact

What it detects

This rule looks for Windows system events that coincide with exploitation activity for the Zerologon vulnerability by matching event IDs 5805 and 5723 alongside the keywords “kali” and “mimikatz”. Attackers may use known tooling to attempt domain compromise, and correlating the relevant event activity with these identifiers can help surface suspicious exploitation attempts. It relies on Windows system telemetry containing the specified EventIDs and keyword text in the same records.

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange

Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com

Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)

Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests

Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters

Suspicious SysAidServer Child Processes via Java on Windows

Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe

Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation

Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host

Pivot detection · T1210 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-zerologon-exploitation-attempt-from-kali-host-using-mimikatz-18f37338

title: Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host
id: ada1319a-15e6-44e3-abd4-802867314147
status: stable
description: This rule looks for Windows system events that coincide with exploitation activity for the Zerologon vulnerability by matching event IDs 5805 and 5723 alongside the keywords “kali” and “mimikatz”. Attackers may use known tooling to attempt domain compromise, and correlating the relevant event activity with these identifiers can help surface suspicious exploitation attempts. It relies on Windows system telemetry containing the specified EventIDs and keyword text in the same records.
references:
  - https://www.secura.com/blog/zero-logon
  - https://bi-zone.medium.com/hunting-for-zerologon-f65c61586382
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/netlogon/win_system_possible_zerologon_exploitation_using_wellknown_tools.yml
author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2021-05-30
tags:
  - attack.t1210
  - attack.lateral-movement
logsource:
  service: system
  product: windows
detection:
  selection:
    EventID:
      - 5805
      - 5723
  keywords:
    - kali
    - mimikatz
  condition: selection and keywords
level: critical
license: DRL-1.1
related:
  - id: 18f37338-b9bd-4117-a039-280c81f7a596
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL