Zerologon Explored: In-Depth Analysis and Mitigation Strategies for Microsoft’s Critical Vulnerability

In this paper, we discuss Zerologon, a critical vulnerability rated at 10 in severity by authorities, and identified as one of the most exploited vulnerabilities in recent years, as per research. It enables a malicious actor to impersonate any computer or root domain controller, thereby infiltrating the network. In other words, an attacker can gain authentication without needing credentials. This paper not only provides background information on the vulnerable system, including a description of the domain controller and remote procedure, but also offers an in-depth analysis of the potential attack methods employed by malicious actors and their resulting impacts. To facilitate better comprehension, we include relevant mathematical formulas and cryptography knowledge in this section. The novelty of this paper primarily lies in the detailed explanation of the three phases of the solution. The first phase is the initial deployment phase; the second is the finding phase; the third is the ’Enforcement Phase.’ This study aims to investigate and analyze the Zerologon vulnerability, focusing on how such attacks infect networks, impact companies, and can be deterred or mitigated.