Detecting DCShadow: Rogue Domain Controller Registration

DCShadow lets an attacker with Domain Admin or equivalent rights inject changes into AD, such as SIDHistory or ACL edits, through replication so that normal change auditing on the DC is bypassed. To do it, the host must briefly look like a DC. That registration, and the RPC traffic around it, is where the detection lives.

Signals at a Glance

The Registration Footprint

A DC is a computer object with a matching nTDSDSA child beneath CN=Sites,CN=Configuration, plus replication SPNs. DCShadow creates those pieces on demand. Directory-service change auditing records the object creation and deletion, and an SPN query on a workstation account is a strong secondary signal. Coverage differs between environments, so test it with a lab run before you rely on it:

index=wineventlog sourcetype="WinEventLog:Security"
    ((EventCode=5137 Object_Class=nTDSDSA)
     OR (EventCode=5141 Object_Class=nTDSDSA)
     OR (EventCode=4742 Service_Principal_Names="*GC/*")
     OR (EventCode=5136 LDAP_Display_Name=servicePrincipalName
         Attribute_Value="GC/*"))
| eval who=coalesce(Subject_Account_Name, SubjectUserName)
| stats earliest(_time) AS first latest(_time) AS last values(EventCode) AS codes
        values(Object_DN) AS objects by who, host
| where mvcount(codes) >= 1
# tune/validate: expect a create-then-delete pair seconds apart.
# Exclude real DC promotion and demotion windows from your change calendar.

A scheduled inventory is the cheapest independent check. Compare the list of nTDSDSA objects against your known Domain Controllers and alert on any difference:

# tune/validate: run from a management host on a schedule; allowlist is yours
$known = Get-Content .\dc-allowlist.txt
$cfg = (Get-ADRootDSE).configurationNamingContext
Get-ADObject -SearchBase "CN=Sites,$cfg" -LDAPFilter "(objectClass=nTDSDSA)" |
  ForEach-Object { ($_.DistinguishedName -split ',')[1] -replace 'CN=','' } |
  Where-Object { $_ -notin $known }

Replication RPC from the Wrong Host

The rogue host must speak the replication RPC interface to a real DC. Domain Controllers have a stable, small set of peers, so a new source IP is easy to spot:

• Alert on DRSUAPI DRSBind and DRSReplicaAdd from an IP outside the DC and documented-tooling list.
• Capture the same RPC with Zeek or your network sensor, since DCShadow changes bypass the originating DC’s usual change events.
• Review privileged-group and SIDHistory changes made through replication; a change with no admin session behind it deserves a case.
• Restrict who can edit the Configuration partition and who holds the rights needed to register a server object.