Enterprise Vulnerability Assessment: Prioritizing Log4Shell & Zerologon (NIST SP 800-115)

Reycardo Montañez Millan — Fri, 30 Oct 2026 00:49:55 +0000

Executive Summary

This report details a credentialed vulnerability assessment conducted on a simulated hospital enterprise infrastructure following the NIST SP 800-115 guidelines. The primary goal was to identify, evaluate, and prioritize critical security flaws across core network services to prevent potential ransomware deployment and unauthorized domain takeover.

Assessment Methodology & Scope

Using credentialed vulnerability scanning, network devices, application servers, and Active Directory Domain Controllers were analyzed against known Common Vulnerabilities and Exposures (CVEs).

Focus areas included:

Electronic Health Record (EHR) Application Servers
Primary Domain Controllers (DC)
External Perimeter Gateways

Critical Findings & Analysis

1. Log4Shell — Remote Code Execution (RCE)

Target System: EHR Application Server
CVE: CVE-2021-44228
CVSSv3 Score: 10.0 (CRITICAL)
Impact: Unauthenticated remote code execution allowing full control over the electronic health records database.
Root Cause: Insecure JNDI lookup handling within the Apache Log4j library.

2. Zerologon — Privilege Escalation

Target System: Primary Domain Controller
CVE: CVE-2020-1472
CVSSv3 Score: 10.0 (CRITICAL)
Impact: Allows an attacker with local network access to instantly reset the Active Directory domain controller's machine account password, leading to complete domain compromise.
Root Cause: Insecure cryptographic implementation in the Netlogon Remote Protocol (MS-NRPC).

Remediation Strategy & Mitigation Timeline

Priority	Target System	CVE	Risk Level	Recommended Action
P1 - Immediate	EHR App Server	`CVE-2021-44228`	Critical (10.0)	Patch Log4j to version 2.17.1+ or apply JVM flag.
P1 - Immediate	Primary DC	`CVE-2020-1472`	Critical (10.0)	Deploy Microsoft Security Update (KB4565349/KB4571687).

Temporary Mitigation Controls (Workarounds)

For immediate mitigation on the EHR Server prior to the full patch window deployment, the following Java Virtual Machine (JVM) parameter was applied:


bash
# Temporary JVM flag to disable JNDI lookups in Log4j 2.10 - 2.14.1
-Dlog4j2.formatMsgNoLookups=true

SOC Case Study: WinRM & PowerShell Attack Triage & Log Correlation

Reycardo Montañez Millan — Fri, 30 Oct 2026 00:42:15 +0000

Executive Summary

This case study outlines the detection, triage, and log correlation process for an unauthorized remote management attack. Using a multi-layered telemetry approach (Wazuh SIEM, Windows Event Logs, and Firewall logs), we traced an attacker's movement from an external brute-force entry to obfuscated PowerShell execution and internal lateral movement.

Detection & Indicators of Compromise (IoCs)

During routine log monitoring, multiple security alerts triggered on the SIEM dashboard indicating anomalous authentication behavior:

Source External IP: 2.57.121.25
Target Protocol: WinRM (Port 5985) - Windows Remote Management
Target Action: Unauthorized remote login attempt and session establishment.

Triage & Investigation Steps

1. Initial Log Correlation

By correlating Windows Event Logs (EVTX) with Wazuh SIEM telemetry, we identified that the external IP successfully authenticated via WinRM.

2. Execution Analysis

Upon establishing the remote session, the attacker spawned wsmprovhost.exe, which immediately triggered an obfuscated Base64-encoded PowerShell command:

Technique: Obfuscated PowerShell execution used to bypass basic string-matching security controls.
MITRE ATT&CK Mapping:
- T1021.006 - Remote Services: Windows Remote Management
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1027 - Obfuscated Files or Information

3. Lateral Movement & Enrichment

Further inspection of internal firewall and SMB logs revealed a subsequent connection attempt targeting admin shares on internal host 10.30.15.30.

Checking the source threat indicators against threat intelligence feeds (such as VirusTotal) yielded multiple malicious flags, confirming the threat actor's infrastructure.

Remediation & Mitigation Recommendations

Restrict WinRM Access: Limit WinRM listeners (Ports 5985/5986) strictly to internal management subnets via Windows Firewall rules.
PowerShell Logging: Ensure Advanced Script Block Logging (Event ID 4104) is fully enabled across all endpoints to capture de-obfuscated script contents.
Account Lockout Policies: Implement aggressive lockout thresholds for administrative accounts exposed to network services.

Authored by Reycardo Montañez Millan — Aspiring Cyber Threat Monitoring Analyst.
Portfolio: https://reymillanworks-oss.github.io/Reymillanworks101/

DEV Community: Reycardo Montañez Millan

Enterprise Vulnerability Assessment: Prioritizing Log4Shell & Zerologon (NIST SP 800-115)

Executive Summary

Assessment Methodology & Scope

Critical Findings & Analysis

1. Log4Shell — Remote Code Execution (RCE)

2. Zerologon — Privilege Escalation

Remediation Strategy & Mitigation Timeline

Temporary Mitigation Controls (Workarounds)

SOC Case Study: WinRM & PowerShell Attack Triage & Log Correlation

Executive Summary

Detection & Indicators of Compromise (IoCs)

Triage & Investigation Steps

1. Initial Log Correlation

2. Execution Analysis

3. Lateral Movement & Enrichment

Remediation & Mitigation Recommendations