Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe
Alerts on cmd.exe launching cool.exe/zero.exe with ZeroLogon PoC-style arguments and follow-on taskkill or PowerShell activity.
- Product
- windows
- Category
- process_creation
- Author
- @Kostastsale, TheDFIRReport (SigmaHQ), DRL 1.1
- Published
- 2022-02-12
- Updated
- 2026-07-31
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creations where cmd.exe launches ZeroLogon PoC executables (cool.exe or zero.exe) with command-line indicators including the Administrator string and '-c'. It also requires evidence of common follow-on commands, such as forced task termination (taskkill /f /im) or PowerShell usage in the same command line. This behavior matters because running PoC tooling is a common precursor to exploiting CVE-2020-1472 and escalating access. The detection relies on Windows process creation telemetry, including ParentImage, Image, and full CommandLine.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/
- thedfirreport.comhttps://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1472/proc_creation_win_exploit_cve_2020_1472_zero_poc.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe"
id: c31a40d1-8d0c-4c27-98b0-4ef3601c3ad8
status: test
description: This rule flags Windows process creations where cmd.exe launches ZeroLogon PoC executables (cool.exe or zero.exe) with command-line indicators including the Administrator string and '-c'. It also requires evidence of common follow-on commands, such as forced task termination (taskkill /f /im) or PowerShell usage in the same command line. This behavior matters because running PoC tooling is a common precursor to exploiting CVE-2020-1472 and escalating access. The detection relies on Windows process creation telemetry, including ParentImage, Image, and full CommandLine.
references:
- https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/
- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1472/proc_creation_win_exploit_cve_2020_1472_zero_poc.yml
author: "@Kostastsale, TheDFIRReport, Huntrule Team"
date: 2022-02-12
tags:
- attack.execution
- attack.lateral-movement
- attack.t1210
- cve.2020-1472
- detection.emerging-threats
logsource:
product: windows
category: process_creation
detection:
selection_main:
ParentImage|endswith: \cmd.exe
Image|endswith:
- \cool.exe
- \zero.exe
CommandLine|contains|all:
- Administrator
- -c
selection_payloads_1:
CommandLine|contains|all:
- taskkill
- /f
- /im
selection_payloads_2:
CommandLine|contains: powershell
condition: selection_main and 1 of selection_payloads_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: dcc6a01e-9471-44a0-a699-71ea96f8ed8b
type: derived