ADTRADE-002: DCShadow Indicator (Rogue Configuration-Partition Servers)
- Plataforma
- Active Directory
- Categoría
- AD Adversary Tradecraft Indicators
- Severidad
- High
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla enumerates every object of class server (and child nTDSDSA objects) under CN=Sites,CN=Configuration,DC=<forest-root> and joins the result with the live domain controller inventory returned by Get-ADDomainController -Filter *. For each server object the check reads dNSHostName, serverReference, whenCreated, whenChanged, and the SPNs registered on the linked computer account (GC/, ldap/, E3514235-4B06-11D1-AB04-00C04FC2DCD2/). A finding is emitted when (a) a server object exists with no corresponding entry in the Domain Controllers OU, (b) a server object was created in the last 90 days but the associated computer account has no DC SPNs or no msDS-IsRODC flag, (c) whenChanged on a server object falls inside a maintenance window that no change ticket covers, or (d) the configurationNamingContext contains an nTDSDSA object whose parent server is not in the AD Sites and Services topology that vCenter, SCCM, or the asset inventory recognises. The check also cross-references the schema container (CN=Schema,CN=Configuration) for recent modifications because the same DCShadow primitive can be used to mint new schema attributes.
Por qué importa
DCShadow is a domain-takeover-grade primitive. Once an attacker can register a rogue DC, they can replicate arbitrary changes into the directory: add a SID of 519 (Enterprise Admins) to any user via sIDHistory, reset krbtgt, write a backdoor ACE onto AdminSDHolder so it propagates to every protected account every hour, change the primary group of a normal user to 512, or push a new schema attribute that survives uninstall. Because the change arrives via legitimate DRSUAPI replication from what AD believes is a valid DC, it is written to every replica in the forest and is indistinguishable from a real administrative action in the security event log on the receiving DCs. Traditional DCSync detections (4662 with the DS-Replication-Get-Changes-All GUID) do not fire, and EDR on production DCs sees nothing because the malicious process runs on the attacker host. The configuration-partition server object is the one durable forensic artefact, and it is the only artefact that survives the rogue DC being unregistered with the /removeobject flag of mimikatz lsadump::dcshadow.
Ruta de ataque
1. Attacker compromises an account with the four rights DCShadow needs: write rights to the Sites container in the configuration partition, write rights to the target object being modified, the SeDebugPrivilege on the attacker host (to spawn the lsass-impersonating service), and the ability to register an SPN. Domain Admins trivially satisfies this, but the original LE TOUX and Delpy paper documents paths via delegated configuration-container ACLs that lower-privileged operators sometimes hold. 2. Attacker runs mimikatz on the attacker-controlled host in two consoles. Console one: lsadump::dcshadow /object:<targetDN> /attribute:sidHistory /value:S-1-5-21-...-519 stages the change. 3. Console two, elevated to SYSTEM: lsadump::dcshadow /push registers the host as a DC by creating the server, nTDSDSA, and computer SPN objects in CN=Sites,CN=Configuration, then opens DRSUAPI on the attacker host and waits. 4. The legitimate DC pulls the staged change via normal replication (DrsReplicaAdd, GetNCChanges) and commits sIDHistory=519 to the target account in the production NTDS.dit. 5. Mimikatz calls lsadump::dcshadow /push again with /removeobject, which deletes the rogue server and nTDSDSA objects, leaving only the configuration-partition tombstones and the replicated payload. 6. Attacker now authenticates as the target user and presents a Kerberos ticket whose PAC includes SID 519, granting Enterprise Admin on every domain in the forest. Detection on the production DCs is essentially zero unless the configuration partition is actively monitored.
Cómo lo evalúa Guerrilla
Guerrilla issues a single LDAP query against the configuration naming context: Get-ADObject -Filter "objectClass -eq 'server'" -SearchBase "CN=Sites,$((Get-ADRootDSE).configurationNamingContext)" -Properties whenCreated, whenChanged, dNSHostName, serverReference. The returned set is intersected with (Get-ADDomainController -Filter *).ComputerObjectDN and any object that exists in the configuration partition but not in the live DC list is emitted as a finding. The check also reads the schema container modification timestamp via (Get-ADRootDSE).schemaNamingContext and warns if the schema has been written in the last 30 days outside a known schema-update ticket. As a detection-time signal, Guerrilla recommends that customers subscribe to event IDs 5137 (directory service object created), 5141 (directory service object deleted), and 4662 (object access) on the schema and configuration naming contexts. Native Microsoft Defender for Identity has a built-in DCShadow alert that triggers on the suspicious DrsReplicaAdd call; Guerrilla validates that the MDI sensor is installed on every DC by cross-referencing with ADLOG-005.
Valor recomendado
All server objects under CN=Sites,CN=Configuration correspond to real, inventoried domain controllers. No recently created server objects that don't match a known DC.
Remediación
Enumerate: Get-ADObject -Filter {objectClass -eq 'server'} -SearchBase "CN=Sites,$((Get-ADRootDSE).configurationNamingContext)" -Properties whenCreated, dNSHostName | Sort whenCreated. Cross-reference with your DC inventory (Get-ADDomainController -Filter *). Any server object not matching a real DC, especially recently created, demands immediate IR — DCShadow is a domain-takeover-grade primitive. Monitor for 5137 / 5141 events on schema container as a detection-time signal.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-4, AU-12
- CIS AD Benchmark
- 10.2.1
- MITRE ATT&CK
- T1207