ZeroLogon

Exploits CVE-2020-1472 in the Netlogon Remote Protocol (MS-NRPC) to authenticate to a vulnerable domain controller with an all-zero client credential and set that controller's Active Directory machine-account password to an empty value. The altered DC computer account can then be used for DRSUAPI replication (DCSync) to obtain only the directory secrets authorized for collection. This requires network reachability to the DC's Netlogon RPC service; the password reset can disrupt the DC secure channel and replication until the original machine-account password is restored.