Possible DC Shadow Attack — Sigma Rule

Rule metadata and linked tags

Author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah. Source status: test; severity: medium. Source dates: 2019-10-25 / 2022-10-17.

{
  "product": "windows",
  "service": "security",
  "definition": "The \"Audit Directory Service Changes\" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 6fe06c05b3b770a3eefb610faaa381e8d765ee741930e227b818a1ae99518d7f

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Possible DC Shadow Attack
id: 32e19d25-4aed-4860-a55a-be99cb0bf7ed
related:
    - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a
      type: derived
status: test
description: Detects DCShadow via create new SPN
references:
    - https://twitter.com/gentilkiwi/status/1003236624925413376
    - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
    - https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah
date: 2019-10-25
modified: 2022-10-17
tags:
    - attack.credential-access
    - attack.defense-impairment
    - attack.t1207
logsource:
    product: windows
    service: security
    definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
    selection1:
        EventID: 4742
        ServicePrincipalNames|contains: 'GC/'
    selection2:
        EventID: 5136
        AttributeLDAPDisplayName: servicePrincipalName
        AttributeValue|startswith: 'GC/'
    condition: 1 of selection*
falsepositives:
    - Valid on domain controllers; exclude known DCs
level: medium

Original YAML and metadata in JSON

False positives

• Valid on domain controllers; exclude known DCs

Source references

• https://twitter.com/gentilkiwi/status/1003236624925413376
• https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
• https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48