Picus Security Releases Automated Tool for Assessing Zerologon Vulnerability

Picus Security has published a new resource to assist IT teams in verifying their defense against CVE-2020-1472, a critical privilege elevation vulnerability in the Netlogon Remote Protocol. The flaw, which received a CVSS score of 10.0, allows unauthenticated attackers to spoof secure channels and potentially seize control of domain controllers.

While Microsoft released security updates for the vulnerability in 2020, Picus Security’s release aims to simplify the validation process for enterprise environments. The tool is a pre-packaged, executable version of existing Python-based testing scripts, removing the need for administrators to install additional dependencies like Python or the Impacket library on target machines.

The utility includes a PowerShell script designed to automate the discovery of the Primary Domain Controller (PDC) and the execution of the diagnostic test. By automating these identification steps, the company intends to streamline security audits, allowing organizations to confirm if their domain controllers are properly patched and configured.

Security professionals are advised to prioritize full patching of all domain controllers and the enforcement of secure RPC connections. Picus Security emphasizes that while validation tools are useful for identifying exposures, they should be used in conjunction with broader network segmentation and multifactor authentication to mitigate the risks associated with domain compromise.