Possible DC Shadow Attack
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects DCShadow via create new SPN
Severity
Trouble
Rule Requirement
Criteria
Action1:
actionname = "Object Changed or Network Share Accessed" AND SERVICEPRINCIPALNAME contains "GC/" OR (DISPLAYNAME = "servicePrincipalName" AND CHANGES startswith "GC/")
select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.TARGETDOMAIN,Action1.TARGETMACHINE,Action1.RELATIVETARGETNAME,Action1.SHARENAME,Action1.SHAREPATH,Action1.OBJECTTYPE,Action1.OBJECTNAME,Action1.CHANGES,Action1.DN,Action1.GUID,Action1.MEMBERGROUPSID,Action1.SECURITYID,Action1.TARGETUSER
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah
