Cross-source coverage
T1207 / ATT&CK
Rogue Domain Controller
14 rules across 4 sources.
From MITRE ATT&CK 19.2
Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.
Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash.
This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform SID-History Injection and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence.
- Tactics
- Defense Impairment
- Platforms
- Windows
- Telemetry
-
WinEventLog:Securitym365:dirsyncNSM:Flow
How MITRE says to detect it DET0276
Detection Strategy for Rogue Domain Controller (DCShadow) Registration and Replication Abuse
Windows Analytic 0770
Detection of rogue Domain Controller registration and Active Directory replication abuse by correlating: (1) creation/modification of nTDSDSA and server objects in the Configuration partition, (2) unexpected usage of Directory Replication Service SPNs (GC/ or E3514235-4B06-11D1-AB04-00C04FC2DCD2), (3) replication RPC calls (DrsAddEntry, DrsReplicaAdd, GetNCChanges) originating from non-DC hosts, and (4) Kerberos authentication by non-DC machines using DRS-related SPNs. These events in combination, especially from hosts outside the Domain Controllers OU, may indicate DCShadow or rogue DC activity.
WinEventLog:SecurityEventCode=4928WinEventLog:SecurityEventCode=4929WinEventLog:SecurityEventCode=4662m365:dirsyncReplication cookie changes involving Configuration partition with new server/nTDSDSA objects.NSM:FlowDrsAddEntry, DrsReplicaAdd, GetNCChanges calls between non-DC and DCs.
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| Windows AD DCShadow Privileges ACL Addition | Undefined | SPL |
| Windows AD Domain Controller Promotion | Undefined | SPL |
| Windows AD Replication Service Traffic | Undefined | SPL |
| Windows AD Rogue Domain Controller Network Activity | Undefined | SPL |
| Windows AD Short Lived Domain Controller SPN Attribute | Undefined | SPL |
| Windows AD Short Lived Server Object | Undefined | SPL |
Wazuh Core Ruleset
4 rules| Detection | Severity | Format |
|---|---|---|
| field failed | High | Wazuh XML |
| field failed. | High | Wazuh XML |
| Windows DC - Possible replay attack | High | Wazuh XML |
| Windows DC - Clock skew too great | Medium | Wazuh XML |
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Possible DC Shadow Attack | Medium | Sigma |
| Add or Remove Computer from DC | Low | Sigma |
socfortress/Wazuh-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · Mimikatz DCShadow Command (T1207) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PsExec Launching DCShadow (T1207) | High | Wazuh XML |