NexurAI
Zerologon and PrintNightmare: from any foothold to Domain Admin in minutes.
A flawed use of AES-CFB8 in Netlogon lets an attacker set a Domain Controller's machine password to empty - instant domain admin from the network.
Windows Netlogon (all supported Windows Server DCs) · 2020
The attacker sends ~256 Netlogon authentication attempts with a zeroed challenge until one succeeds, then resets the DC's computer account password and dumps domain credentials (DCSync).
Alert on Netlogon events 4742/5805, a burst of NetrServerAuthenticate calls, and machine-account password changes for a DC; EDR on lsass access and DCSync replication from non-DC hosts.
Apply the August 2020 patch and enforce 'secure RPC' (enforcement mode); monitor for accounts using vulnerable Netlogon.
The Print Spooler service lets an authenticated user load an arbitrary driver DLL as SYSTEM - remote code execution and privilege escalation.
Windows Print Spooler (RpcAddPrinterDriverEx) · 2021
The attacker points the spooler at a malicious 'printer driver' DLL on a share; spoolsv.exe loads it with SYSTEM privileges and runs the payload.
Watch spoolsv.exe spawning cmd/powershell or writing DLLs under C:\Windows\System32\spool\drivers; alert on new drivers added over RPC/SMB.
Patch, disable the Print Spooler where not needed, and restrict 'Point and Print' driver installation to administrators.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.