The attacker sends ~256 Netlogon authentication attempts with a zeroed challenge until one succeeds, then resets the DC's computer account password and dumps domain credentials (DCSync).

Alert on Netlogon events 4742/5805, a burst of NetrServerAuthenticate calls, and machine-account password changes for a DC; EDR on lsass access and DCSync replication from non-DC hosts.

Apply the August 2020 patch and enforce 'secure RPC' (enforcement mode); monitor for accounts using vulnerable Netlogon.

The attacker sends crafted RDP requests to a vulnerable host before authentication, achieving RCE - with worm potential across RDP-exposed networks.

Alert on internet-exposed 3389/tcp, RDP scanning, and BlueKeep exploit signatures; watch for RDP service crashes.

Patch, require Network Level Authentication (NLA), and keep RDP off the internet (VPN/gateway only).

The attacker requests a crafted URL to read the sslvpn session file, harvesting usernames and passwords, then logs into the VPN as a real user.

Alert on requests to /remote/fgt_lang?lang=/../ or sslvpn_websession reads, and on VPN logins that follow from new IPs shortly after.

Patch FortiOS, then reset ALL VPN credentials (leaked creds persist after patching), and enforce MFA on the VPN.

The attacker abuses the Autodiscover SSRF to reach the backend PowerShell endpoint, then writes an ASPX webshell to a known Exchange path for persistence and RCE.

Hunt for new .aspx files in Exchange virtual directories, suspicious /autodiscover/autodiscover.json?...&Email=autodiscover requests in IIS logs, and w3wp.exe spawning cmd/powershell.

Patch Exchange to the latest CU/SU, review IIS logs and webroots for shells, and restrict external access to Exchange management endpoints.