Techniques › T1207
T1207 Rogue Domain Controller
defense impairment — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
2
Sigma rules tagged attack.t1207
0
KEV CVEs mapped here
<p>Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.</p><p>Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash.</p><p>This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform SID-History Injection and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0276 Detection Strategy for Rogue Domain Controller (DCShadow) Registration and Replication Abuse v1.0
AN0770 WindowsDetection of rogue Domain Controller registration and Active Directory replication abuse by correlating: (1) creation/modification of nTDSDSA and server objects in the Configuration partition, (2) unexpected usage of Directory Replication Service SPNs (GC/ or E3514235-4B06-11D1-AB04-00C04FC2DCD2), (3) replication RPC calls (DrsAddEntry, DrsReplicaAdd, GetNCChanges) originating from non-DC hosts, and (4) Kerberos authentication by non-DC machines using DRS-related SPNs. These events in combination, especially from hosts outside the Domain Controllers OU, may indicate DCShadow or rogue DC activity.m365:dirsync
Replication cookie changes involving Configuration partition with new server/nTDSDSA objects.→ DC0066 Active Directory Object ModificationNSM:FlowDrsAddEntry, DrsReplicaAdd, GetNCChanges calls between non-DC and DCs.→ DC0085 Network Traffic ContentTunable:TimeWindowAllowedReplicationPartnersSuspiciousSPNsNonDCObjectCreationAlert
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1207
Author: frack113
· 2022-10-14 · logsource: product=windows service=security · 20d96d95-5a20-4cf1-a483-f3bda8a7c037
Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.
Author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah
· 2019-10-25 (modified 2022-10-17) · logsource: product=windows service=security · 32e19d25-4aed-4860-a55a-be99cb0bf7ed
Detects DCShadow via create new SPN