osquery_queries/win_attacks/zerologon_anonymous_password_change.yaml

[johnosn]

The single quotes in side the query should be changed to double quotes.

query: 'SELECT * FROM windows_eventlog evt
WHERE evt.channel="Security"
AND evt.eventid LIKE 4742
AND evt.data LIKE regex_match(evt.data,"{\"EventData\":{.+\"SubjectUserSid\":\"S-1-5-7\"PasswordLastSet\":\"[^-].+}$",0); '

[cmarczewski]

Hi Adam.

Thank you for bringing this to our attention. We resolved this issue via 7e0d107.