Can EventSentry detect the ZeroLogon attack?

EventSentry can detect both successful and unsuccessful ZeroLogon attacks by examing various event patterns on domain computers. To use this package:

• Download the package using the link shown below
• Open the EventSentry management console
• Click on "Packages"
• Click on "Import"
• Select the "ZeroLogon" package

eventsentry_package_zerologon.reg