Windows ZeroLogon PoC Execution via cmd.exe Launching cool.exe or zero.exe

title: Windows ZeroLogon PoC Execution via cmd.exe Launching cool.exe or zero.exe
id: c31a40d1-8d0c-4c27-98b0-4ef3601c3ad8
status: test
description: This rule flags process creation where cmd.exe launches cool.exe or zero.exe with command-line arguments indicating an attempt to execute the ZeroLogon proof-of-concept. The behavior matters because attackers may use the PoC to exploit CVE-2020-1472 and gain elevated privileges within a domain environment. It relies on Windows process creation telemetry, matching executable names, parent process, and specific command-line strings (including Administrator, taskkill usage, or PowerShell).
references:
  - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1472/proc_creation_win_exploit_cve_2020_1472_zero_poc.yml
author: "@Kostastsale, TheDFIRReport, Huntrule Team"
date: 2022-02-12
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1210
  - cve.2020-1472
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection_main:
    ParentImage|endswith: \cmd.exe
    Image|endswith:
      - \cool.exe
      - \zero.exe
    CommandLine|contains|all:
      - Administrator
      - -c
  selection_payloads_1:
    CommandLine|contains|all:
      - taskkill
      - /f
      - /im
  selection_payloads_2:
    CommandLine|contains: powershell
  condition: selection_main and 1 of selection_payloads_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: dcc6a01e-9471-44a0-a699-71ea96f8ed8b
    type: derived