Detecting and Mitigating Rogue Domain Controller DCShadow (T1207)

Rogue Domain Controller (MITRE ATT&CK T1207) is the registration of a fake domain controller so an adversary can change Active Directory data. The method is called DCShadow. MITRE files it under Defense Impairment and lists Windows.

How attackers use it

DCShadow creates a rogue domain controller (DC) by registering, or reusing an inactive registration, and then simulates DC behavior. Once registered, the rogue DC may be able to inject and replicate changes into the AD infrastructure for any domain object, including credentials and keys.

Registering one means creating a new server object and nTDSDSA object in the Configuration partition of the AD schema. That requires administrator privileges (Domain or local to the DC) or the KRBTGT hash.

MITRE says this may bypass system logging and security monitors such as SIEM products, since actions on a rogue DC may not be reported to those sensors. It can also alter or delete replication and related metadata to hinder forensic work. Adversaries may use it for SID-History injection or to change objects such as accounts and access control lists, creating backdoors for persistence.

How to detect it

MITRE's detection strategy correlates four things:

1. Creation or modification of nTDSDSA and server objects in the Configuration partition.
2. Unexpected use of Directory Replication Service SPNs (GC/ or E3514235-4B06-11D1-AB04-00C04FC2DCD2).
3. Replication RPC calls (DrsAddEntry, DrsReplicaAdd, GetNCChanges) from hosts that are not domain controllers.
4. Kerberos authentication by non-DC machines using DRS-related SPNs.

Events from hosts outside the Domain Controllers OU make the case stronger. Turn on Directory Service Changes auditing so that object creation and deletion in the directory are logged (Event IDs 5137 and 5141). Read-only checks: auditpol /get /category:"DS Access" shows the audit setting, and repadmin /showrepl lists replication partners for a DC.

How to reduce the risk

MITRE says this technique cannot be easily mitigated with preventive controls, since it abuses system features. The defenses are tight control of who holds domain administrator rights, protection of the KRBTGT account, and good directory auditing so the few events that appear are noticed.

Quick check

Sources

• MITRE ATT&CK T1207: Rogue Domain Controller