Techniques › T1207 › AN0770
AN0770 Analytic 0770
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of rogue Domain Controller registration and Active Directory replication abuse by correlating: (1) creation/modification of nTDSDSA and server objects in the Configuration partition, (2) unexpected usage of Directory Replication Service SPNs (GC/ or E3514235-4B06-11D1-AB04-00C04FC2DCD2), (3) replication RPC calls (DrsAddEntry, DrsReplicaAdd, GetNCChanges) originating from non-DC hosts, and (4) Kerberos authentication by non-DC machines using DRS-related SPNs. These events in combination, especially from hosts outside the Domain Controllers OU, may indicate DCShadow or rogue DC activity.</p>
- Detects
- T1207 Rogue Domain Controller
- Part of
- DET0276 Detection Strategy for Rogue Domain Controller (DCShadow) Registration and Replication Abuse
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4928 | DC0087 Active Directory Object Creation |
| WinEventLog:Security | EventCode=4929 | DC0084 Active Directory Credential Request |
| WinEventLog:Security | EventCode=4662 | DC0071 Active Directory Object Access |
| m365:dirsync | Replication cookie changes involving Configuration partition with new server/nTDSDSA objects. | DC0066 Active Directory Object Modification |
| NSM:Flow | DrsAddEntry, DrsReplicaAdd, GetNCChanges calls between non-DC and DCs. | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Window (seconds) between nTDSDSA object creation and subsequent replication traffic from same host (default 300s). |
AllowedReplicationPartners | List of legitimate DCs authorized for replication to reduce false positives. |
SuspiciousSPNs | SPNs indicating replication service usage (GC/, GUID E3514235-4B06-11D1-AB04-00C04FC2DCD2). |
NonDCObjectCreationAlert | Trigger alerts only when AD object creation is by accounts not in Domain Admins or Enterprise Admins groups. |