How to detect True positive for event id 5829 Zerologon.

Question

Hi

We have enabled the patches for Aug 2020 for Zero logon , after that I am getting High number of events from event id 5829.
Not able to detect the true positive. Its flooding in SIEM .

Event Name : The Netlogon service allowed a vulnerable Netlogon secure channel connection

In event I can able to see the logs categeory system and subcategeory Netlogon and Source is DC.

Need to know how to detect true positive out of it.

Regards
Admin

Answer 1

On the problem member you can do from PowerShell.
Test-ComputerSecureChannel
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

Hello @Aamir Bin Jamal ,

Thank you for posting here.

Based on the description, do we want to find the device accounts or trust accounts through Event ID 5829?

If so, we can see as below based on the link below.

How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472
https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc

If anything I misunderstood you, please correct me.

Thank you for your understanding.

Best Regards,
Daisy Zhou

Answer 3

Hi Daisy and Patrick

Thanks for your response its helpful .

@Daisy : I am also getting the same set of fields as you mentioned here .

But the information is not much to analyze the true positive . I am getting same SAM Account name and DC name in all my events.

Can you please help me in correlating this alert with others to get correct results.

regards
Admin