Detect Rogue Domain Controller in Microsoft Sentinel
Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. Once registered, a rogue DC may inject and replicate changes into AD infrastructure for any domain object, including credentials, group memberships, and SID history. Registering a rogue DC involves creating new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (Domain or local DC) or the KRBTGT hash. This technique bypasses most SIEM sensors since changes are pushed directly via AD replication without touching standard audit paths. Mimikatz implements DCShadow via the lsadump::dcshadow module, requiring two concurrent sessions: one running as SYSTEM to register the rogue DC and stage changes, and one running as a domain admin to trigger the replication push.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1207 Rogue Domain Controller
- Canonical reference
- https://attack.mitre.org/techniques/T1207/
KQL Detection Query
// Detect DCShadow / Rogue Domain Controller attacks via four parallel detection branches
// Branch 1: Mimikatz DCShadow command-line arguments (MDE process telemetry)
let MimikatzDCShadow = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("lsadump::dcshadow", "dcshadow /push", "dcshadow /start", "dcshadow /domain", "dcshadow /object", "dcshadow /attribute")
or (FileName =~ "mimikatz.exe" and ProcessCommandLine has "dcshadow")
| extend DetectionBranch = "MimikatzDCShadow",
AlertReason = "Mimikatz DCShadow command-line arguments detected on endpoint"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch, AlertReason;
// Branch 2: Rogue DC registration — nTDSDSA object created in AD Configuration partition
// Requires: Security Events connector collecting from Domain Controllers
let RogueDCRegistration = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 5137
| where EventData has "nTDSDSA" or EventData has "NTDS Settings"
| extend DetectionBranch = "RogueDCObjectCreated",
AlertReason = "nTDSDSA object created in AD Configuration partition — possible rogue DC registration"
| project TimeGenerated as Timestamp, Computer as DeviceName, SubjectUserName as AccountName,
tostring(EventData), DetectionBranch, AlertReason;
// Branch 3: Unexpected AD replication source established or removed on Domain Controllers
let ReplicationSourceChange = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4928, 4929)
| extend DetectionBranch = "ReplicationSourceChange",
AlertReason = iff(EventID == 4928,
"AD replica source naming context established — verify this is a legitimate DC",
"AD replica source naming context removed — verify expected decommission")
| project TimeGenerated as Timestamp, Computer as DeviceName, SubjectUserName as AccountName,
tostring(EventData), DetectionBranch, AlertReason;
// Branch 4: Computer account gaining DC-specific SPNs (rogue DC SPN registration)
let DCLikeSPNAdded = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4742
| where EventData has "GC/" or EventData has "E3514235-4B06-11D1-AB04-00C04FC2DCD2"
| extend DetectionBranch = "DCLikeSPNAdded",
AlertReason = "Computer account modified with Global Catalog or DRSUapi SPN — possible rogue DC SPN registration"
| project TimeGenerated as Timestamp, Computer as DeviceName, SubjectUserName as AccountName,
tostring(EventData), DetectionBranch, AlertReason;
union MimikatzDCShadow, RogueDCRegistration, ReplicationSourceChange, DCLikeSPNAdded
| sort by Timestamp descDetects DCShadow rogue domain controller attacks via four parallel branches: (1) Mimikatz DCShadow command-line arguments in MDE DeviceProcessEvents; (2) nTDSDSA directory service object creation (Security Event 5137) indicating rogue DC registration in the AD Configuration partition; (3) unexpected replication source establishment or removal (Security Events 4928/4929) on domain controllers; and (4) computer account modifications adding Global Catalog or DRSUapi SPNs (Security Event 4742) indicative of rogue DC SPN registration. Branches 2-4 require Windows Security Event log collection from Domain Controllers in Microsoft Sentinel.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Domain Controller promotion (dcpromo or Add-WindowsFeature AD-Domain-Services) creates nTDSDSA objects in the Configuration partition — always correlate with approved change management tickets
- Read-Only Domain Controller (RODC) deployment and RODC password replication policy changes generate replication source events that resemble DCShadow indicators
- AD migration tools such as Active Directory Migration Tool (ADMT) or Quest Migration Manager that temporarily register replication partners during inter-forest or inter-domain migrations
- Disaster recovery scenarios involving authoritative AD restore or DC rebuild from backup may produce replication source changes and SPNs resembling rogue DC activity
- Security researchers and red teams validating DCShadow detection capabilities in authorized lab environments — verify against approved penetration testing schedules
Other platforms for T1207
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Existing DC Registrations (Baseline / Forensic Recon)
Expected signal: Sysmon Event ID 1: powershell.exe process creation with LDAP query arguments. No directory service modification events (read-only). PowerShell ScriptBlock Log Event ID 4104 capturing the LDAP filter targeting nTDSDSA objectClass. No network connections beyond standard LDAP to port 389.
- Test 2DCShadow Stage Phase — Register Rogue DC (Mimikatz SYSTEM Session)
Expected signal: Sysmon Event ID 1: mimikatz.exe process creation under NT AUTHORITY\SYSTEM context, CommandLine containing lsadump::dcshadow. Windows Security Event ID 5137 on Domain Controllers: new nTDSDSA object created under CN=Sites in the Configuration partition. Windows Security Event ID 4742: computer account of the attacking machine modified with GC/ and DRSUapi SPNs added. Sysmon Event ID 3: RPC connections from mimikatz.exe to DC on port 135 and dynamic RPC ports.
- Test 3DCShadow Push Phase — Trigger Replication (Mimikatz Domain Admin Session)
Expected signal: Sysmon Event ID 1: mimikatz.exe process creation with lsadump::dcshadow /push argument. Windows Security Event ID 4928 on receiving Domain Controllers: replica source naming context established, showing the rogue DC as the source. Windows Security Event ID 5136 on DCs: attribute modification on the target AD object (description attribute). Sysmon Event ID 3: outbound RPC connections to legitimate DC IP addresses on dynamic ports.
- Test 4Validate Replication Topology for Rogue DC Partners
Expected signal: Sysmon Event ID 1: repadmin.exe process creation (multiple instances for each flag). No AD modification events (read-only diagnostic). The /showconn output lists all inbound and outbound replication connections — any connection referencing an unexpected computer name or GUID identifies a rogue DC that has successfully registered in the replication topology.
References (10)
- https://attack.mitre.org/techniques/T1207/
- https://www.dcshadow.com/
- https://adsecurity.org/?page_id=1821
- https://github.com/shellster/DCSYNCMonitor
- https://adds-security.blogspot.fr/2018/02/detecter-dcshadow-impossible.html
- https://msdn.microsoft.com/en-us/library/ms677626.aspx
- https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/directory-services-component-updates
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5137
Unlock Pro Content
Get the full detection package for T1207 including response playbook, investigation guide, and atomic red team tests.