MalwareExploits 1 CVE

Machine.Modules.ZerologonInterface.dll

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2020-1472Zerologon

Machine.Modules.ZerologonInterface.dll This DLL reaches out to given domain controllers (passed as a parameter) to see if they're vulnerable to Zerologon, and if so, responds with usernames and hashed passwords. It then restores the computer hash for the domain controller to its original state.

via fortinet threat researchfortinet.com

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

FortiGuard Labs recently discovered an unidentified threat actor leveraging ProxyShell exploits... web shells created from ProxyShell vulnerabilities.

Persistence

1 technique

T1505.003Web ShellEvidence1

Exploit details, from the directories to the types of web shells used, matched almost verbatim. The difference was when web shells performed post-exploitation activity via DLLs loaded into memory...

Credential Access

1 technique

T1212Exploitation for Credential AccessEvidence1

Machine.Modules.ZerologonInterface.dll This DLL reaches out to given domain controllers... to see if they're vulnerable to Zerologon, and if so, responds with usernames and hashed passwords.

Lateral Movement

1 technique

T1550.002Pass the HashEvidence1

The DLLs... were used to perform active reconnaissance, obtain hashed passwords via Zerologon, and perform pass-the-hash authentication to establish persistence via Exchange Application Impersonation.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

fortinet threat researchNews

Sep 14, 2021

More ProxyShell? Web Shells Lead to ZeroLogon and Application Impersonation Attacks | FortiGuardLabs

A malicious DLL used to test domain controllers for Zerologon exposure and extract usernames and hashed passwords, then restore the original computer hash to reduce disruption and aid stealth.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

Machine.Modules.ZerologonInterface.dll

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2020-1472Zerologon

via fortinet threat researchfortinet.com

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

FortiGuard Labs recently discovered an unidentified threat actor leveraging ProxyShell exploits... web shells created from ProxyShell vulnerabilities.

Persistence

1 technique

T1505.003Web ShellEvidence1

Exploit details, from the directories to the types of web shells used, matched almost verbatim. The difference was when web shells performed post-exploitation activity via DLLs loaded into memory...

Credential Access

1 technique

T1212Exploitation for Credential AccessEvidence1

Machine.Modules.ZerologonInterface.dll This DLL reaches out to given domain controllers... to see if they're vulnerable to Zerologon, and if so, responds with usernames and hashed passwords.

Lateral Movement

1 technique

T1550.002Pass the HashEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

fortinet threat researchNews

Sep 14, 2021

More ProxyShell? Web Shells Lead to ZeroLogon and Application Impersonation Attacks | FortiGuardLabs

A malicious DLL used to test domain controllers for Zerologon exposure and extract usernames and hashed passwords, then restore the original computer hash to reduce disruption and aid stealth.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.