Summary
Event ID 4742 is triggered when a computer object is changed, usually when a reboot is made to the domain. It is important to avoid changing any user-related settings manually for computer objects, as this will result in the computer account becoming a user account.
1
To detect the abuse of the Zerologon vulnerability, look for the event ID 4742 and hunt for ANONYMOUS LOGON users, and SID in the event ID 4742 with the Password Last Set field changed.
2
Additionally, account change-related activity of all domain controllers in the Active Directory can be monitored to prevent the ZeroLogon attack.
3
According to
See more results on Neeva
Summaries from the best pages on the web
Summary
This event is generated every time a computer object is changed, usually when a reboot is made to the domain. It is important to avoid changing any user-related settings manually for computer objects, as this will result in the computer account becoming a user account. The event is triggered by the Security ID, account name, account domain, and logon ID, and can be used to correlate recent events with the same account.
4742(S) A computer account was changed. (Windows 10) - Windows security | Microsoft Docs
microsoft.com
Summary
To detect the abuse of the Zerologon vulnerability, look for the event ID 4742. To be specific, hunt for ANONYMOUS LOGON users, and SID in the event ID 4742 with the Password Last Set field changed.
You can also look for account change-related activity of all domain controllers in the Active Directory.
Zerologon - Detecting the vulnerability in SIEM - Logpoint
logpoint.com
Summary
This post provides defensive strategies to mitigate the ZeroLogon (CVE-2020-1472) vulnerability, which allows attackers to set a password for the computer account of an Active Directory Domain Controller and pull credentials from the Domain Controller. It outlines the attack's telemetry, detection techniques, and recommendations for preventing the ZeroLogon attack. Additionally, it provides a link to a white paper on ZeroLogon and a vulnerability disclosure tool to help protect against this vulnerability.
From Lares Labs: Defensive Guidance for ZeroLogon (CVE-2020-1472) - Lares
lares.com
