Rogue Domain Controller

// Detect DCShadow / Rogue Domain Controller attacks via four parallel detection branches
// Branch 1: Mimikatz DCShadow command-line arguments (MDE process telemetry)
let MimikatzDCShadow = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("lsadump::dcshadow", "dcshadow /push", "dcshadow /start", "dcshadow /domain", "dcshadow /object", "dcshadow /attribute")
    or (FileName =~ "mimikatz.exe" and ProcessCommandLine has "dcshadow")
| extend DetectionBranch = "MimikatzDCShadow",
         AlertReason = "Mimikatz DCShadow command-line arguments detected on endpoint"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch, AlertReason;
// Branch 2: Rogue DC registration — nTDSDSA object created in AD Configuration partition
// Requires: Security Events connector collecting from Domain Controllers
let RogueDCRegistration = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 5137
| where EventData has "nTDSDSA" or EventData has "NTDS Settings"
| extend DetectionBranch = "RogueDCObjectCreated",
         AlertReason = "nTDSDSA object created in AD Configuration partition — possible rogue DC registration"
| project TimeGenerated as Timestamp, Computer as DeviceName, SubjectUserName as AccountName,
         tostring(EventData), DetectionBranch, AlertReason;
// Branch 3: Unexpected AD replication source established or removed on Domain Controllers
let ReplicationSourceChange = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4928, 4929)
| extend DetectionBranch = "ReplicationSourceChange",
         AlertReason = iff(EventID == 4928,
             "AD replica source naming context established — verify this is a legitimate DC",
             "AD replica source naming context removed — verify expected decommission")
| project TimeGenerated as Timestamp, Computer as DeviceName, SubjectUserName as AccountName,
         tostring(EventData), DetectionBranch, AlertReason;
// Branch 4: Computer account gaining DC-specific SPNs (rogue DC SPN registration)
let DCLikeSPNAdded = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4742
| where EventData has "GC/" or EventData has "E3514235-4B06-11D1-AB04-00C04FC2DCD2"
| extend DetectionBranch = "DCLikeSPNAdded",
         AlertReason = "Computer account modified with Global Catalog or DRSUapi SPN — possible rogue DC SPN registration"
| project TimeGenerated as Timestamp, Computer as DeviceName, SubjectUserName as AccountName,
         tostring(EventData), DetectionBranch, AlertReason;
union MimikatzDCShadow, RogueDCRegistration, ReplicationSourceChange, DCLikeSPNAdded
| sort by Timestamp desc

((index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (CommandLine="*lsadump::dcshadow*" OR CommandLine="*dcshadow /push*" OR CommandLine="*dcshadow /start*"
   OR CommandLine="*dcshadow /domain*" OR CommandLine="*dcshadow /object*" OR CommandLine="*dcshadow /attribute*"))
OR
(index=wineventlog sourcetype="WinEventLog:Security" EventCode=5137
  (Message="*nTDSDSA*" OR Message="*NTDS Settings*"))
OR
(index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4928 OR EventCode=4929))
OR
(index=wineventlog sourcetype="WinEventLog:Security" EventCode=4742
  (Message="*GC/*" OR Message="*E3514235-4B06-11D1-AB04-00C04FC2DCD2*")))
| eval DetectionBranch=case(
    EventCode="1", "MimikatzDCShadow",
    EventCode="5137", "RogueDCObjectCreated",
    (EventCode="4928" OR EventCode="4929"), "ReplicationSourceChange",
    EventCode="4742", "DCLikeSPNAdded",
    true(), "Unknown")
| eval AlertReason=case(
    EventCode="1", "Mimikatz DCShadow command-line arguments detected on endpoint",
    EventCode="5137", "nTDSDSA object created in AD Configuration partition — possible rogue DC registration",
    EventCode="4928", "AD replica source naming context established — verify this is a legitimate DC",
    EventCode="4929", "AD replica source naming context removed — verify expected decommission",
    EventCode="4742", "Computer account modified with DC-like SPN (GC/ or DRSUapi UUID)",
    true(), "DCShadow indicator")
| eval TargetAccount=coalesce(User, SubjectUserName, TargetUserName)
| table _time, host, ComputerName, TargetAccount, CommandLine, EventCode, DetectionBranch, AlertReason
| sort - _time

any where
  (
    event.code == "1" and
    (
      process.command_line : ("*lsadump::dcshadow*", "*dcshadow /push*", "*dcshadow /start*",
                               "*dcshadow /domain*", "*dcshadow /object*", "*dcshadow /attribute*")
      or (process.name : "mimikatz.exe" and process.command_line : "*dcshadow*")
    )
  ) or
  (
    event.code == "5137" and
    (
      winlog.event_data.ObjectClass : "nTDSDSA"
      or winlog.event_data.ObjectDN : "*NTDS Settings*"
      or message : "*nTDSDSA*"
    )
  ) or
  (
    event.code in ("4928", "4929") and
    winlog.channel : "Security"
  ) or
  (
    event.code == "4742" and
    (
      winlog.event_data.ServicePrincipalNames : "*GC/*"
      or winlog.event_data.ServicePrincipalNames : "*E3514235-4B06-11D1-AB04-00C04FC2DCD2*"
      or message : "*E3514235-4B06-11D1-AB04-00C04FC2DCD2*"
    )
  )

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  username,
  sourceip,
  "EventID",
  CASE
    WHEN "EventID" = '1'              THEN 'MimikatzDCShadow'
    WHEN "EventID" = '5137'           THEN 'RogueDCObjectCreated'
    WHEN "EventID" IN ('4928','4929') THEN 'ReplicationSourceChange'
    WHEN "EventID" = '4742'           THEN 'DCLikeSPNAdded'
    ELSE 'DCShadowIndicator'
  END AS DetectionBranch,
  CASE
    WHEN "EventID" = '1'    THEN 'Mimikatz DCShadow command-line arguments detected on endpoint'
    WHEN "EventID" = '5137' THEN 'nTDSDSA object created in AD Configuration partition - possible rogue DC registration'
    WHEN "EventID" = '4928' THEN 'AD replica source naming context established - verify this is a legitimate DC'
    WHEN "EventID" = '4929' THEN 'AD replica source naming context removed - verify expected decommission'
    WHEN "EventID" = '4742' THEN 'Computer account modified with Global Catalog or DRSUapi SPN'
    ELSE 'DCShadow indicator'
  END AS AlertReason,
  payload
FROM events
WHERE
  (
    (
      "EventID" = '1'
      AND (
        payload ILIKE '%lsadump::dcshadow%'
        OR payload ILIKE '%dcshadow /push%'
        OR payload ILIKE '%dcshadow /start%'
        OR payload ILIKE '%dcshadow /domain%'
        OR payload ILIKE '%dcshadow /object%'
        OR payload ILIKE '%dcshadow /attribute%'
      )
    )
    OR (
      "EventID" = '5137'
      AND (payload ILIKE '%nTDSDSA%' OR payload ILIKE '%NTDS Settings%')
    )
    OR "EventID" IN ('4928', '4929')
    OR (
      "EventID" = '4742'
      AND (
        payload ILIKE '%GC/%'
        OR payload ILIKE '%E3514235-4B06-11D1-AB04-00C04FC2DCD2%'
      )
    )
  )
LAST 24 HOURS
ORDER BY starttime DESC

(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*wineventlog*)
(EventCode=1 OR EventCode=5137 OR EventCode=4928 OR EventCode=4929 OR EventCode=4742)
| where
  (EventCode = "1" and
    (CommandLine contains "lsadump::dcshadow"
     or CommandLine contains "dcshadow /push"
     or CommandLine contains "dcshadow /start"
     or CommandLine contains "dcshadow /domain"
     or CommandLine contains "dcshadow /object"
     or CommandLine contains "dcshadow /attribute"))
  or (EventCode = "5137" and
    (Message contains "nTDSDSA" or Message contains "NTDS Settings"))
  or (EventCode = "4928")
  or (EventCode = "4929")
  or (EventCode = "4742" and
    (Message contains "GC/" or Message contains "E3514235-4B06-11D1-AB04-00C04FC2DCD2"))
| eval DetectionBranch = if(EventCode = "1", "MimikatzDCShadow",
    if(EventCode = "5137", "RogueDCObjectCreated",
      if(EventCode = "4928" or EventCode = "4929", "ReplicationSourceChange",
        "DCLikeSPNAdded")))
| eval AlertReason = if(EventCode = "1",
    "Mimikatz DCShadow command-line arguments detected on endpoint",
    if(EventCode = "5137",
      "nTDSDSA object created in AD Configuration partition - possible rogue DC registration",
      if(EventCode = "4928",
        "AD replica source naming context established - verify this is a legitimate DC",
        if(EventCode = "4929",
          "AD replica source naming context removed - verify expected decommission",
          "Computer account modified with DC-like SPN (GC/ or DRSUapi UUID)"))))
| fields _messageTime, _sourceHost, ComputerName, UserName, SubjectUserName, CommandLine, EventCode, DetectionBranch, AlertReason
| sort by _messageTime desc

rule T1207_Rogue_Domain_Controller {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects DCShadow / Rogue Domain Controller attacks via Mimikatz process arguments, nTDSDSA AD object creation, AD replication source changes, and DC-like SPN additions to computer accounts"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1207"
    severity = "CRITICAL"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1207/"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      (
        re.regex($e.target.process.command_line, `(?i)lsadump::dcshadow`) or
        re.regex($e.target.process.command_line, `(?i)dcshadow\s+/(push|start|domain|object|attribute)`)
      )
    ) or
    (
      $e.metadata.product_event_type = "5137" and
      (
        re.regex($e.target.resource.name, `(?i)nTDSDSA`) or
        re.regex($e.security_result.description, `(?i)NTDS\s+Settings`)
      )
    ) or
    (
      $e.metadata.product_event_type = "4928" or
      $e.metadata.product_event_type = "4929"
    ) or
    (
      $e.metadata.product_event_type = "4742" and
      (
        re.regex($e.target.resource.attribute.labels["ServicePrincipalNames"], `GC/`) or
        re.regex($e.target.resource.attribute.labels["ServicePrincipalNames"], `E3514235-4B06-11D1-AB04-00C04FC2DCD2`)
      )
    )

  condition:
    $e
}

union(
  {
    #event_simpleName=ProcessRollup2
    | CommandLine=/(?i)(lsadump::dcshadow|dcshadow\s+\/(push|start|domain|object|attribute))/
    | DetectionBranch:="MimikatzDCShadow"
    | AlertReason:="Mimikatz DCShadow command-line arguments detected on endpoint"
  },
  {
    EventID=5137
    | Message=/nTDSDSA|NTDS\s+Settings/
    | DetectionBranch:="RogueDCObjectCreated"
    | AlertReason:="nTDSDSA object created in AD Configuration partition - possible rogue DC registration"
  },
  {
    EventID in (4928, 4929)
    | case {
        EventID=4928
          | DetectionBranch:="ReplicationSourceEstablished"
          | AlertReason:="AD replica source naming context established - verify this is a legitimate DC" ;
        EventID=4929
          | DetectionBranch:="ReplicationSourceRemoved"
          | AlertReason:="AD replica source naming context removed - verify expected decommission" ;
        *
          | DetectionBranch:="ReplicationSourceChange"
          | AlertReason:="AD replication source change detected" ;
      }
  },
  {
    EventID=4742
    | Message=/GC\/|E3514235-4B06-11D1-AB04-00C04FC2DCD2/
    | DetectionBranch:="DCLikeSPNAdded"
    | AlertReason:="Computer account modified with Global Catalog or DRSUapi SPN - possible rogue DC registration"
  }
)
| table([_time, ComputerName, UserName, CommandLine, EventID, DetectionBranch, AlertReason])
| sort(field=_time, order=desc)