Skip to main content

DCShadow

ATT&CK: T1207 — Rogue Domain Controller

DCShadow is an Active Directory persistence and evasion technique where an attacker registers a rogue domain controller in the AD topology, then uses it to push arbitrary attribute changes to AD — bypassing standard security monitoring that watches legitimate DC event logs.

How DCShadow Works​

Normal AD replication: DCs use the MS-DRSR (Directory Replication Service Remote Protocol) to synchronize changes. Any DC registered in AD can initiate replication.

DCShadow abuse:

  1. Register a rogue DC — create nTDSDSA and Server objects in the AD Sites and Services configuration partition to make a compromised machine appear as a DC
  2. Push malicious changes — the rogue DC replicates attribute changes to legitimate DCs; these changes arrive via replication, not direct modification
  3. Clean up — remove the rogue DC objects after the changes are committed

Because the changes arrive via DC-to-DC replication rather than standard LDAP writes, they do not generate Event ID 4662/5136 (object modification events) on the legitimate DCs — they appear as normal replication.

Payload Examples​

What can be injected via DCShadow:

PayloadEffect
Add SID to sIDHistoryGive account access to another domain's resources
Set primaryGroupIDChange group membership without a group modification event
Set adminCount = 1Move account into AdminSDHolder protection scope
Modify msDS-KeyCredentialLinkAdd shadow credentials for persistence
Modify ACLs on AD objectsGrant DCSync rights, WriteDACL, etc.
Set servicePrincipalNameRegister SPN for targeted Kerberoasting
Set userAccountControlRemove PREAUTH required → AS-REP Roasting target

Tool: Mimikatz lsadump::dcshadow​

# In a privileged shell on the target (needs Domain Admin or specific replication rights)

# Register the rogue DC (run as SYSTEM or DA)
mimikatz # lsadump::dcshadow /object:targetuser /attribute:SIDHistory /value:S-1-5-21-<old-domain>-500

# In a second Mimikatz instance with Domain Admin privileges:
mimikatz # lsadump::dcshadow /push

# The second instance triggers the replication push

DCShadow requires two simultaneous Mimikatz processes:

  • One running as SYSTEM on the machine being registered as rogue DC
  • One running with Domain Admin credentials to trigger the replication

Privilege Requirements​

RequirementDetail
Register rogue DC objectsDomain Admin or write access to CN=Configuration partition
Push replicationDomain Admin or DS-Replication-Manage-Topology + DS-Replication-Synchronize rights
EffectivelyDomain Admin equivalent required

DCShadow is a post-exploitation persistence technique — not an initial access vector. An attacker needs Domain Admin before using it, then uses DCShadow to maintain persistence while evading detection.

Comparison: DCSync vs DCShadow​

DCSyncDCShadow
DirectionPull (read credentials)Push (write AD changes)
PurposeCredential extractionPersistence, evasion
Log eventsEvent 4662 on DCsReplication events only
Detection difficultyModerateHard
RequiresReplication rightsAbility to register DC + replication rights

Detection​

Event IDs to Monitor​

Event IDSourceRelevance
4928AD ReplicationSource naming context replica added
4929AD ReplicationSource naming context replica removed
4930AD ReplicationSource naming context replica modified
4932AD ReplicationSynchronization of a replica of an AD naming context
4935/4936AD ReplicationReplication failure begins/ends

Behavioral Indicators​

DCShadow leaves a short-lived registration artifact:

# Rogue DC objects created in:
CN=Sites,CN=Configuration,DC=domain,DC=com

# Specifically:
CN=<machine-name>,CN=Servers,CN=<site>,CN=Sites,...
CN=NTDS Settings,CN=<machine-name>,...

Detections:

  1. New DC registration in Sites & Services that is not a legitimate deployment
  2. Replication events from unexpected source IP/hostname
  3. Attribute changes arriving via replication that were not initiated via normal change management

Sigma Rule Concept​

title: DCShadow — Unexpected DC Registration
detection:
  selection:
    EventID: 4928
  filter_known:
    # Allowlist known DCs by hostname or IP
    ReplicaSourceNC|contains: known_dc_list
  condition: selection and not filter_known

MDI Detection​

Microsoft Defender for Identity has a specific detection for DCShadow:

  • "Suspected DCShadow attack (DC promotion)"
  • "Suspected DCShadow attack (replication request)"

These detections fire when a non-DC machine initiates replication requests.

Mitigation​

ControlMechanism
Restrict DC registration rightsOnly designated accounts can create nTDSDSA objects in the configuration partition
Monitor Sites & Services changesAlert on new server/DC registrations
Privileged Access WorkstationsReduce locations where DA credentials are used
Tier 0 protectionLimit who has Domain Admin

CTI Context​

DCShadow was presented by Benjamin Delpy (Mimikatz author) and Vincent Le Toux at BlueHat IL 2018. It has been used in sophisticated APT operations where attackers with DA access needed to modify AD attributes without triggering standard change detection pipelines.

Evidence that DCShadow was used is typically found post-compromise through AD forensics:

  • Unexpected SID History entries
  • ACL changes with no corresponding modification events
  • Group membership changes with no corresponding memberOf change events
TopicLink
DCSyncdcsync
SID History Abusesid-history-abuse
ACL Abuseacl-abuse
Golden Ticketgolden-ticket