CVE-2020-1472 | Netlogon Elevation of Privilege Vulnerability

Ajishlal

Hi

Any IPS signature released for to prevent this Netlogon Elevation of Privilege Vulnerability?

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472

Micah

Hello @Ajishlal, we have it!

Please see IPS 15143 under MANAGE > Security Services > Intrusion Prevention.

Ajishlal

Hi @Micah

Thank you & well noted.