{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1207","id":"T1207","name":"Rogue Domain Controller","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1207","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"3c8fc1992e7a3d6eb7558e545486ae11a43a26ad26a31a79c29e6e640b69f029","description":"Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. (Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.\n\nRegistering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide)\n\nThis technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1134/005) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1207","external_id":"T1207"},{"source_name":"DCShadow Blog","description":"Delpy, B. & LE TOUX, V. (n.d.). DCShadow. Retrieved March 20, 2018.","url":"https://www.dcshadow.com/"},{"source_name":"Adsecurity Mimikatz Guide","description":"Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz & Command Reference. Retrieved December 23, 2015.","url":"https://adsecurity.org/?page_id=1821"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0084","name":"Active Directory Credential Request","page":"telemetry/DC0084/","kind":"attack_component","category":"Windows and directory audit","description":"Directory authentication service requests, such as Kerberos ticket requests.","collection_focus":"Enable the relevant Account Logon subcategories on DCs, including Kerberos Authentication Service and Service Ticket Operations; preserve service/account, encryption and result.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","service_principal","request_type","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0084","collector":"illustrative-lab-collector","observation":{"account":"lab-user","service_principal":"cifs/lab-server.example.test","request_type":"service_ticket","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0071","name":"Active Directory Object Access","page":"telemetry/DC0071/","kind":"attack_component","category":"Windows and directory audit","description":"Access to Active Directory objects and properties.","collection_focus":"Enable Audit Directory Service Access and scoped object SACLs; interpret access masks and property GUIDs in their directory context.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["object_dn","access","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0071","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","access":"read_property","actor":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0087","name":"Active Directory Object Creation","page":"telemetry/DC0087/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of an Active Directory object.","collection_focus":"Enable Audit Directory Service Changes with matching SACLs and retain created object class, GUID, DN and actor.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["object_guid","object_class","object_dn","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0087","collector":"illustrative-lab-collector","observation":{"object_guid":"lab-object-2","object_class":"group","object_dn":"CN=LabReaders,OU=Lab,DC=example,DC=test","action":"create"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0066","name":"Active Directory Object Modification","page":"telemetry/DC0066/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an Active Directory object attribute.","collection_focus":"Enable Audit Directory Service Changes with appropriate object SACLs on lab DCs; retain 5136 attribute/value and correlation context.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["object_dn","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1207","id":"T1207","name":"Rogue Domain Controller","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1207","technique_page":"techniques/enterprise/T1207/","page":"detections/enterprise/T1207/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"20d96d95-5a20-4cf1-a483-f3bda8a7c037","title":"Add or Remove Computer from DC","status":"test","level":"low","logsource":{"service":"security","product":"windows"},"data_path":"data/detection-rules/20d96d95-5a20-4cf1-a483-f3bda8a7c037.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_add_remove_computer.yml","author":"frack113","kind":"sigma"},{"id":"32e19d25-4aed-4860-a55a-be99cb0bf7ed","title":"Possible DC Shadow Attack","status":"test","level":"medium","logsource":{"product":"windows","service":"security","definition":"The \"Audit Directory Service Changes\" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)"},"data_path":"data/detection-rules/32e19d25-4aed-4860-a55a-be99cb0bf7ed.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_possible_dc_shadow.yml","author":"Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0276","name":"Detection Strategy for Rogue Domain Controller (DCShadow) Registration and Replication Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0276","stix_id":"x-mitre-detection-strategy--f012e122-9f78-4370-a481-d2efaa181359","relationship_id":"relationship--a5f42918-93c0-4537-9780-bfbe67920812","description":"","analytics":[{"id":"AN0770","name":"Analytic 0770","guidance":"Detection of rogue Domain Controller registration and Active Directory replication abuse by correlating: (1) creation/modification of nTDSDSA and server objects in the Configuration partition, (2) unexpected usage of Directory Replication Service SPNs (GC/ or E3514235-4B06-11D1-AB04-00C04FC2DCD2), (3) replication RPC calls (DrsAddEntry, DrsReplicaAdd, GetNCChanges) originating from non-DC hosts, and (4) Kerberos authentication by non-DC machines using DRS-related SPNs. These events in combination, especially from hosts outside the Domain Controllers OU, may indicate DCShadow or rogue DC activity.","url":"https://attack.mitre.org/detectionstrategies/DET0276#AN0770","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Window (seconds) between nTDSDSA object creation and subsequent replication traffic from same host (default 300s)."},{"field":"AllowedReplicationPartners","description":"List of legitimate DCs authorized for replication to reduce false positives."},{"field":"SuspiciousSPNs","description":"SPNs indicating replication service usage (GC/, GUID E3514235-4B06-11D1-AB04-00C04FC2DCD2)."},{"field":"NonDCObjectCreationAlert","description":"Trigger alerts only when AD object creation is by accounts not in Domain Admins or Enterprise Admins groups."}],"log_sources":[{"component_id":"DC0087","component":"Active Directory Object Creation","name":"WinEventLog:Security","channel":"EventCode=4928","platforms":["Windows"],"analytic_id":"AN0770","source_url":"https://attack.mitre.org/detectionstrategies/DET0276#AN0770","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0087/"},{"component_id":"DC0084","component":"Active Directory Credential Request","name":"WinEventLog:Security","channel":"EventCode=4929","platforms":["Windows"],"analytic_id":"AN0770","source_url":"https://attack.mitre.org/detectionstrategies/DET0276#AN0770","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0084/"},{"component_id":"DC0071","component":"Active Directory Object Access","name":"WinEventLog:Security","channel":"EventCode=4662","platforms":["Windows"],"analytic_id":"AN0770","source_url":"https://attack.mitre.org/detectionstrategies/DET0276#AN0770","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0071/"},{"component_id":"DC0066","component":"Active Directory Object Modification","name":"m365:dirsync","channel":"Replication cookie changes involving Configuration partition with new server/nTDSDSA objects.","platforms":["Windows"],"analytic_id":"AN0770","source_url":"https://attack.mitre.org/detectionstrategies/DET0276#AN0770","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0066/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"DrsAddEntry, DrsReplicaAdd, GetNCChanges calls between non-DC and DCs.","platforms":["Windows"],"analytic_id":"AN0770","source_url":"https://attack.mitre.org/detectionstrategies/DET0276#AN0770","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0084","name":"Active Directory Credential Request","tag":"Active Directory Credential Request","page":"telemetry/DC0084/","kind":"attack_component"},{"id":"DC0071","name":"Active Directory Object Access","tag":"Active Directory Object Access","page":"telemetry/DC0071/","kind":"attack_component"},{"id":"DC0087","name":"Active Directory Object Creation","tag":"Active Directory Object Creation","page":"telemetry/DC0087/","kind":"attack_component"},{"id":"DC0066","name":"Active Directory Object Modification","tag":"Active Directory Object Modification","page":"telemetry/DC0066/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0002","name":"Mimikatz","page":"tools/S0002/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0002","name":"Mimikatz","page":"tools/S0002/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0002","name":"Mimikatz","url":"https://attack.mitre.org/software/S0002","kind":"tool","description":"[Mimikatz](https://attack.mitre.org/software/S0002)’s <code>LSADUMP::DCShadow</code> module can be used to make AD updates by temporarily setting a computer to be a DC.(Citation: Deply Mimikatz)(Citation: Adsecurity Mimikatz Guide)","relationship_id":"relationship--15fe2d8e-9a4e-433e-9dca-d7329e7ca846","references":[{"source_name":"Deply Mimikatz","description":"Deply, B. (n.d.). Mimikatz. Retrieved September 29, 2015.","url":"https://github.com/gentilkiwi/mimikatz"},{"source_name":"Adsecurity Mimikatz Guide","description":"Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz & Command Reference. Retrieved December 23, 2015.","url":"https://adsecurity.org/?page_id=1821"}]}],"actors":[],"mitigations":[],"candidates":[{"id":"0f4c5eb0-98a0-4496-9c3d-656b4f2bc8f6","name":"DCShadow (Active Directory)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1207/T1207.yaml","description":"Use Mimikatz DCShadow method to simulate behavior of an Active Directory Domain Controller and edit protected attribute.\n\n[DCShadow](https://www.dcshadow.com/)\n[Additional Reference](http://www.labofapenetrationtester.com/2018/04/dcshadow.html)\n\nIt will set the badPwdCount attribute of the target user (user/machine account) to 9999. You can check after with:\nGet-ADObject -LDAPFilter '(samaccountname=<user>)' -Properties badpwdcount | select-object -ExpandProperty badpwdcount\n\nNeed SYSTEM privileges locally (automatically obtained via PsExec, so running as admin is sufficient), and Domain Admin remotely.\nThe easiest is to run elevated and as a Domain Admin user.\n","inputs":{"object":{"description":"Targeted object (for machine account do not forget to add final '$')","type":"string","default":"bruce.wayne"},"attribute":{"description":"Object attribute to edit, interesting ones: badpwdcount, primaryGroupId, SIDHistory...","type":"string","default":"badpwdcount"},"value":{"description":"Value to assign to object attribute","type":"string","default":"9999"},"mimikatz_path":{"description":"Mimikatz windows executable","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\mimikatz\\x64\\mimikatz.exe"},"psexec_path":{"description":"Path to PsExec","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\PSTools\\PsExec.exe"}},"dependencies":[{"description":"Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})\n"},{"description":"PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_path})\n"}],"source_definition_sha256":"62845ad24d44535dd6ac45aeddc0abce9635d5ad0f7a52030929681ddb902e23"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1134.005":"/ttp-simulation/techniques/enterprise/T1134.005/","T1207":"/ttp-simulation/techniques/enterprise/T1207/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1207","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0084","collector":"illustrative-lab-collector","observation":{"account":"lab-user","service_principal":"cifs/lab-server.example.test","request_type":"service_ticket","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0071","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","access":"read_property","actor":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0087","collector":"illustrative-lab-collector","observation":{"object_guid":"lab-object-2","object_class":"group","object_dn":"CN=LabReaders,OU=Lab,DC=example,DC=test","action":"create"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}}]}}