Possible DC Shadow Attack

Status: test
Severity: medium
Log source: product windows, service security
Author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah
Source: github.com/SigmaHQ/sigma

Detects DCShadow via create new SPN

Known false positives

Valid on domain controllers; exclude known DCs

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1207` Rogue Domain Controller

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4742: A computer account was changed.
Security-Auditing	Event ID 5136: A directory service object was modified.

Rule body

title: Possible DC Shadow Attack
id: 32e19d25-4aed-4860-a55a-be99cb0bf7ed
related:
    - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a
      type: derived
status: test
description: Detects DCShadow via create new SPN
references:
    - https://twitter.com/gentilkiwi/status/1003236624925413376
    - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
    - https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah
date: 2019-10-25
modified: 2022-10-17
tags:
    - attack.credential-access
    - attack.defense-impairment
    - attack.t1207
logsource:
    product: windows
    service: security
    definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
    selection1:
        EventID: 4742
        ServicePrincipalNames|contains: 'GC/'
    selection2:
        EventID: 5136
        AttributeLDAPDisplayName: servicePrincipalName
        AttributeValue|startswith: 'GC/'
    condition: 1 of selection*
falsepositives:
    - Valid on domain controllers; exclude known DCs
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection1`

selection1:
    EventID: 4742
    ServicePrincipalNames|contains: 'GC/'

Stage 2: `selection2`

selection2:
    EventID: 5136
    AttributeLDAPDisplayName: servicePrincipalName
    AttributeValue|startswith: 'GC/'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AttributeLDAPDisplayName`	eq	`servicePrincipalName` corpus 9 (sigma 4, splunk 3, elastic 1, kusto 1)	`field:"AttributeLDAPDisplayName" kind:eq value:"servicePrincipalName"`
`AttributeValue`	starts_with	`GC/` corpus 2 (sigma 2)	`field:"AttributeValue" kind:starts_with value:"GC/"`
`ServicePrincipalNames`	match	`GC/` corpus 2 (sigma 2)	`field:"ServicePrincipalNames" kind:match value:"GC/"`

Possible DC Shadow Attack

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection1

Stage 2: selection2

Indicators

Stage 0: `condition`

Stage 1: `selection1`

Stage 2: `selection2`