rule: Insecure NetLogon auth - likely Zerologon (CVE-2020-1472) attempt

[jdu2600]

The legacy NetLogon ETW provider includes NegotiatedFlags parameter of the NetrServerAuthenticate3 MS-NRPC call. The 2nd bit is the 'Secure RPC' flag which Zerologon needs to disable. Flagging on Netlogon authentication attempts with this flag disabled should be very high fidelity signal for Zerologon attempts.

Issues - I couldn't find any examples on how do do a couple of things in Sigma. How do I specify a non-eventlog ETW provider? How do I check a flag in Sigma?

Bigger Issue - As far as I know, SilkService and Sealighter are the only two generic ETW logging services - and neither is a supported Sigma backend (yet). So nobody can use it straight away...

• https://github.com/fireeye/SilkETW
• https://github.com/pathtofile/Sealighter

[jdu2600]

Added more information on how to detect via the new events on patched systems.

[jdu2600]

Fixed yamllint errors. :-)

[nasbench]

Closing this as it's not currently planned to add the modifier described by the author, unfortunately. Will re-open in case of any new information.