Possible DC Shadow Attack
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects DCShadow via create new SPN
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Object Changed or Network Share Accessed" AND SERVICEPRINCIPALNAME contains "GC/" OR (DISPLAYNAME = "servicePrincipalName" AND CHANGES startswith "GC/") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.TARGETDOMAIN,Action1.TARGETMACHINE,Action1.RELATIVETARGETNAME,Action1.SHARENAME,Action1.SHAREPATH,Action1.OBJECTTYPE,Action1.OBJECTNAME,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah
