CVE-2026-41089 — Windows Netlogon RCE (Domain Controller Takeover)

Looks for: any process whose parent is lsass.exe on a DC, minus benign Windows error/EFS handlers. Accomplishes: catches the exact moment of SYSTEM code execution inside the Netlogon service — the single highest-fidelity signal for this CVE. Healthy DCs almost never show lsass as a parent.

// HUNT: Netlogon/lsass child process on Domain Controller
// MITRE: T1210, T1068, T1203 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 parent/child telemetry on DCs
// TUNING: extend exclusions only after a 7-day DC baseline
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| $falcon/helper:enrich(field=ProductType)
| ProductType=/Domain Controller/
| ParentBaseFileName=/^lsass\.exe$/i
| FileName!=/^(WerFault|wermgr|efsui)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ImageFileName, SHA256HashData], sortby=@timestamp, order=desc, limit=200)

Looks for: command interpreters and common LOLBins running on a DC. Accomplishes: a DC is an appliance — ad-hoc shells are abnormal and frequently the first hands-on-keyboard step after SYSTEM is obtained.

// HUNT: Suspicious interpreter/LOLBin on Domain Controller
// MITRE: T1059, T1068 | CONF: high  FP: low-medium  COST: low
// TUNING: exclude trusted admin parent chains and maintenance accounts
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| $falcon/helper:enrich(field=ProductType)
| ProductType=/Domain Controller/
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|bitsadmin|certutil|at|schtasks)\.exe$/i
| ParentBaseFileName=/^(lsass|services|svchost|wmiprvse|spoolsv)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], sortby=@timestamp, order=desc, limit=200)

Looks for: inbound connections to the DC RPC endpoint mapper (TCP 135) ranked by source to surface rare/new talkers. Accomplishes: highlights the delivery vector. Best run as a baselining hunt — exclude known DC/admin subnets and review outliers.

// HUNT: Rare-source inbound RPC to Domain Controllers
// MITRE: T1210 | CONF: medium  FP: high  COST: medium
// TUNING: maintain a trusted-subnet allowlist; alert on rare sources only
#event_simpleName=NetworkReceiveAcceptIP4
| $falcon/helper:enrich(field=ProductType)
| ProductType=/Domain Controller/
| LocalPort=135
// exclude trusted management/DC subnets (edit to your environment):
| RemoteAddressIP4!=/^10\.0\.0\./
| groupBy([ComputerName, RemoteAddressIP4], function=[count(as=conn_count), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
| sort(conn_count, order=asc)
| table([ComputerName, RemoteAddressIP4, conn_count, first_seen, last_seen], limit=200)

Looks for: SCM events showing Netlogon stopping/crashing or lsass faulting. Accomplishes: failed exploitation typically crashes Netlogon while a successful run usually does not — making crashes a valuable early-warning of probing.

// HUNT: Netlogon/lsass service crash or unexpected restart on DC
// MITRE: T1210, T1203 (tripwire) | CONF: medium  FP: medium  COST: low
// REQUIRES: Windows System + Application event log source in NG-SIEM
// TUNING: suppress during change windows; correlate with Q3 inbound RPC bursts
#repo=windows_logs
| Channel=/^(System|Application)$/
| (EventID=7034 OR EventID=7031 OR EventID=7036 OR (EventID=1000 AND param2=/netlogon\.dll|lsass\.exe/i))
| (Message=/Netlogon/i OR param1=/Netlogon/i)
| table([@timestamp, ComputerName, EventID, Channel, Message], sortby=@timestamp, order=desc, limit=200)

Looks for: nltest, dsquery, net group/user, trust-enumeration command lines on a DC. Accomplishes: typical hands-on-keyboard recon following DC compromise.

// HUNT: SYSTEM-context AD discovery on Domain Controller
// MITRE: T1482, T1087, T1018 | CONF: medium  FP: medium  COST: low
// TUNING: exclude known automation service accounts and scheduled tasks
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| $falcon/helper:enrich(field=ProductType)
| ProductType=/Domain Controller/
| (FileName=/^(nltest|dsquery|dsget|whoami)\.exe$/i
   OR (FileName=/^net1?\.exe$/i AND CommandLine=/\b(group|user|accounts|localgroup)\b/i)
   OR CommandLine=/(domain_trusts|trusted_domains|\/dclist|\/domain)/i)
| UserName=/^(SYSTEM|.+\$)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], sortby=@timestamp, order=desc, limit=200)

Looks for: command lines for extracting the AD database or dumping LSASS — ntdsutil IFM, comsvcs.dll MiniDump, vssadmin shadow copies, ntds.dit references. Accomplishes: detects the credential-theft objective that typically follows DC SYSTEM access.

// HUNT: NTDS / LSASS credential dumping
// MITRE: T1003.003, T1003.001 | CONF: high  FP: low  COST: low
// TUNING: exclude approved backup service accounts and change-window activity
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| (CommandLine=/ntds\.dit/i
   OR CommandLine=/ntdsutil.*(ifm|create full)/i
   OR CommandLine=/comsvcs\.dll.*(MiniDump|#24)/i
   OR CommandLine=/procdump.*lsass/i
   OR CommandLine=/vssadmin.*create.*shadow/i
   OR CommandLine=/reg.*save.*(sam|security|system)/i)
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], sortby=@timestamp, order=desc, limit=200)

Looks for: new PE files written on a DC where the writing process is lsass, netlogon, or a shell/LOLBin. Accomplishes: catches tooling/payload staged on the DC after exploitation (ingress tool transfer).

// HUNT: Executable dropped on DC by lsass/shell context
// MITRE: T1105 | CONF: medium  FP: low-medium  COST: low
// TUNING: exclude TiWorker, TrustedInstaller, msiexec and patch windows
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| $falcon/helper:enrich(field=ProductType)
| ProductType=/Domain Controller/
| ContextBaseFileName=/^(lsass|netlogon|cmd|powershell|pwsh|rundll32|regsvr32|mshta)\.exe$/i
| table([@timestamp, aid, ComputerName, ContextBaseFileName, TargetFileName, SHA256HashData], sortby=@timestamp, order=desc, limit=200)

Looks for: outbound connections whose initiating process is lsass.exe to ports outside the normal AD/replication set. Accomplishes: a compromised Netlogon (in lsass) reaching out for C2 is highly anomalous — lsass should only talk standard AD ports to other DCs.

// HUNT: lsass.exe anomalous outbound connection (Netlogon C2)
// MITRE: T1071, T1105 | CONF: high  FP: low-medium  COST: low-medium
// TUNING: allowlist your DC IPs as destinations; exclude standard AD ports
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^lsass\.exe$/i
| !in(RemotePort, values=[88, 389, 636, 445, 3268, 3269, 53, 123, 135])
| RemoteAddressIP4!=/^(127\.|169\.254\.)/
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, Protocol], sortby=@timestamp, order=desc, limit=200)

# Reports the Netlogon.dll file version on every DC so you can confirm the patch.
# Compare returned version against the MSRC-listed fixed build for each OS.
$dcs = (Get-ADDomainController -Filter *).HostName
foreach ($dc in $dcs) {
  try {
    $v = Invoke-Command -ComputerName $dc -ScriptBlock {
      (Get-Item "$env:SystemRoot\System32\netlogon.dll").VersionInfo.FileVersion
    } -ErrorAction Stop
    [pscustomobject]@{ DC = $dc; NetlogonDllVersion = $v }
  } catch {
    [pscustomobject]@{ DC = $dc; NetlogonDllVersion = "UNREACHABLE: $($_.Exception.Message)" }
  }
}

# Scope the RPC endpoint mapper (TCP 135) to trusted management/DC subnets.
# DO NOT pair this with a second explicit Block rule on the same port. The Windows
# Filtering Platform does NOT evaluate host rules in creation order -- an explicit
# Block always overrides an explicit Allow. A "block everything else" rule on TCP/135
# therefore closes RPC-EPM to your Tier-0 subnets as well, and on a DC that takes out
# AD replication, DCOM, WMI, RSAT/GPMC, DFSR and print. Use a scoped Allow plus a
# default-deny inbound posture instead -- the profile default does the blocking.

# PILOT ON ONE NON-CRITICAL DC. Staged disabled: review, then enable deliberately.
$trusted = @("10.10.0.0/24","10.10.1.0/24")   # <-- replace with your Tier-0 subnets

# 1. Record current state so you can roll back exactly.
$before = Get-NetFirewallProfile -Name Domain | Select-Object Name, DefaultInboundAction
$before | Format-Table -AutoSize

# 2. Create the scoped allow rule, DISABLED. Nothing changes yet.
New-NetFirewallRule -DisplayName "Restrict RPC-EPM (CVE-2026-41089)" `
  -Direction Inbound -Protocol TCP -LocalPort 135 `
  -RemoteAddress $trusted -Action Allow -Profile Domain -Enabled False

# 3. Confirm the rule matches what you intended, THEN enable it.
Get-NetFirewallRule -DisplayName "Restrict RPC-EPM (CVE-2026-41089)" |
  Get-NetFirewallAddressFilter
# Enable-NetFirewallRule -DisplayName "Restrict RPC-EPM (CVE-2026-41089)"

# 4. Only after step 3 verifies clean, set the profile default. This is what
#    actually blocks untrusted sources -- not a second explicit Block rule.
# Set-NetFirewallProfile -Name Domain -DefaultInboundAction Block

# Optional: pin the RPC dynamic port range so firewall/NDR rules stay accurate
# netsh int ipv4 set dynamicport tcp start=49152 num=16384

Prerequisites: a non-critical pilot DC; your real Tier-0 CIDRs; console or iLO/DRAC access to the pilot DC in case you lose RPC to it. Reboot required: no.

Verify — run all three from a TRUSTED subnet before touching a second DC:
Test-NetConnection <pilot-dc> -Port 135 must return TcpTestSucceeded : True.
repadmin /replsummary must show no new failures for the pilot DC.
Get-NetFirewallProfile -Name Domain | Select DefaultInboundAction confirms the posture you expect. Then repeat from an UNTRUSTED subnet and confirm 135 is refused.

Rollback:
Remove-NetFirewallRule -DisplayName "Restrict RPC-EPM (CVE-2026-41089)"
Set-NetFirewallProfile -Name Domain -DefaultInboundAction NotConfigured (or whatever $before recorded in step 1). If you have already lost RPC to the DC, roll back from the console or unlink the GPO from a working DC and run gpupdate /force after regaining access.

# Turn on the audit subcategories behind the native audit-log hunts.
# Prefer deploying via the "Advanced Audit Policy Configuration" GPO on the DC OU.
auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"User Account Management"     /success:enable /failure:enable
auditpol /set /subcategory:"Logon"                       /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Access"    /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation"            /success:enable

# Include command line in 4688 events (GPO: Administrative Templates > System >
# Audit Process Creation > "Include command line in process creation events" = Enabled)
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" `
  /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f

# Verify Netlogon secure-channel enforcement (post-Zerologon hardening) is ON:
reg query "HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" /v FullSecureChannelProtection