0

ZeroLogon checklist:

  • August 11, 2020 updates have been deployed on all domain controllers.
  • February 9, 2021 updates have been deployed on all domain controllers.
  • All devices are running Windows 10.
  • All devices are fully updated.
  • Domain member: Digitally encrypt or sign secure channel data (always) is set to Enabled.

See https://support.microsoft.com/en-us/topic/how-to-manage-the-changes-in-netlogon-secure-channel-connections-associated-with-cve-2020-1472-f7e8cc17-0309-1d6a-304e-5ba73cd1a11e for more info.

After the August 11, 2020 updates have been applied to DCs, events can be collected in DC event logs to determine which devices in your environment are using vulnerable Netlogon secure channel connections (referred to as non-compliant devices in this article). Monitor patched DCs for event ID 5829 events. The events will include relevant information for identifying the non-compliant devices.

Despite all of this, the following Splunk search still returns results:

index="wineventlog"
sourcetype="wineventlog"
EventCode IN (5827, 5828, 5829)
| top limit=100 EventCode, Machine_SamAccountName
| sort count DESC
| table Machine_SamAccountName, EventCode, count

How can I determine if these events are false positives?

Improve this question
5
  • I'm not sure that I understand. If the events are logged, then they are logged. According to your link, you check to see if the devices are patched and if the devices in fact are logging those events.
    – schroeder ♦
    Nov 20 at 9:58
  • Fron your link: By default, supported versions of Windows that have been fully updated should not be using vulnerable Netlogon secure channel connections. If one of these events is logged in the system event log for a Windows device: Confirm that the device is running a supported versions of Windows. Ensure the device is fully updated. Check to ensure that Domain member: Digitally encrypt or sign secure channel data (always) is set to Enabled.
    – schroeder ♦
    Nov 20 at 9:59
  • So, your link appears to answer your question. If all those conditions are true (and confirmed), then it looks like there is a false positive.
    – schroeder ♦
    Nov 20 at 9:59
  • I don't understand either. On the one hand, the events are logged. On the other hand, the devices are fully updated. This sounds like an impossible situation, unless the information on the Microsoft website is wrong or incomplete. So, the link doesn't answer my question, in fact, it caused my question.
    – Amedee Van Gasse
    Nov 20 at 10:34
  • My point is that you will need to dig into each device to confirm that everything is as expected. And if all that is according to what MS has stated, then it's a false positive. That's the implication of the link. I can go into things like "have you rebooted the machines?" etc. to suggest ways that you could have done all the right things but it is still a problem, but that's all guesswork.
    – schroeder ♦
    Nov 20 at 10:38

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .