Threat Hunting Exercise: Analyzing Windows DCShadow Rogue Domain Controller Registration Dataset
This hunt uses a simulated Active Directory replication dataset (windows_dcshadow_2022-08-04T230000.json) capturing T1207: Rogue Domain Controller, where an attacker with domain admin rights temporarily registers a compromised machine as a domain controller to inject malicious directory changes (e.g., SIDHistory, backdoor group memberships) via legitimate replication, bypassing standard audit logging on the real DCs.
Step 1: Hypothesis Formation
Hypothesis: A non-domain-controller machine registers itself as a replication endpoint by writing to the Configuration partition (CN=Configuration,CN=Sites) and briefly appears as a source in inbound replication traffic, followed by a directory object change that lacks the normal 4662/5136 audit trail on that object from a real DC. Indicators:
- A workstation/server object (not in the Domain Controllers OU) briefly registered with
NTDSDSAandspnCliConnattributes. - Inbound DRSUAPI (DsReplicaSync/DsGetNCChanges) traffic sourced from a non-DC IP.
- The replication-registering account holds Domain Admin or delegated replication rights (Replicating Directory Changes / Changes All).
- A sensitive attribute changes (e.g., SIDHistory, group membership) with no matching security event on any legitimate DC.
Null Hypothesis: A legitimate DC promotion/demotion or an authorized replication topology change (e.g., new read-only DC staging) is in progress. Invalidate by checking the AD change-control calendar and confirming the object was never formally promoted via dcpromo.
Rationale: DCShadow is designed specifically to evade standard AD change auditing by injecting changes through replication rather than direct writes; this hunt validates DRSUAPI-source and Configuration-partition-registration monitoring as a detection layer independent of object-level audit logs.
Step 2: Data Sources and Scope
- Sources: Domain Controller Security Event Logs (4662 - Directory Service Access, 5136 - Directory Service Object Modified); Network traffic on DRSUAPI/RPC (port 135, dynamic RPC); AD replication metadata (
repadmin /showrepl). - Scope: ~2022-08-04T23:00:00-23:06:00 UTC; Source host: SRV-APP-071 (10.150.4.61, not a domain controller); Account: svc-backup-admin.
- SIEM Queries (Splunk/ELK):
index=wineventlog EventCode=4662 Object_Type="nTDSDSA" | table _time Account_Name Object_Name Client_Address- Replication source anomaly:
repadmin /showrepl * /csv | where SourceDSA not in (KnownDCList) - DRSUAPI network:
index=network dest_port=135 rpc_interface="DRSUAPI" | stats count by src_ip, dest_ip | where src_ip not in (dc_ip_list)
Step 3: Key Findings
Parsed events (6 shown) confirm SRV-APP-071 briefly registered as a replication partner and pushed a SIDHistory modification to a low-privilege account, with no corresponding 5136 event on any legitimate DC.
| Timestamp (UTC) | Source | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-08-04 23:00:11 | SRV-APP-071 | 4662 - nTDSDSA object created under Configuration partition | Object registered by svc-backup-admin | Registration IOC: a non-DC server registering an NTDS-DSA object is the hallmark first step of DCShadow. |
| 2022-08-04 23:01:05 | SRV-APP-071 → DC01 | DRSUAPI DsReplicaAdd/DsReplicaSync | Inbound replication call sourced from a non-DC IP | Protocol IOC: legitimate replication only ever originates from registered domain controllers; SRV-APP-071 is a member server. |
| 2022-08-04 23:01:40 | SRV-APP-071 | Directory object change | sIDHistory attribute added to user "j.arnold" containing a Domain Admins SID | Payload IOC: this is the actual privilege-escalation backdoor DCShadow was used to plant. |
| 2022-08-04 23:02:00 | - | (audit gap check) | No 5136 event exists on DC01 or DC02 for this change | Evasion confirmed: the change bypassed native DC-side auditing, the defining characteristic of DCShadow vs. a normal AD write. |
| 2022-08-04 23:03:15 | SRV-APP-071 | nTDSDSA object deleted | Rogue "DC" de-registers itself within 3 minutes of use | Cleanup IOC: transient registration matching Mimikatz lsadump::dcshadow push-then-remove behavior. |
| - | - | (account context) | svc-backup-admin holds "Replicating Directory Changes All" via a delegated ACL added 2 days prior | Confirms the attacker pre-staged replication rights before executing the attack. |
Validation:
- Timeline: registration, single malicious replication push, and self-deregistration all within 3 minutes - matches the documented DCShadow attack pattern precisely.
- False Positives: no change-control ticket authorizes any DC promotion or replication topology change on SRV-APP-071; the target attribute (SIDHistory containing a Domain Admins SID) has no legitimate business purpose.
- Correlation: replication-rights grant, rogue registration, and the audit-log gap on real DCs together form very high confidence evidence of DCShadow.
Step 4: Recommendations & Next Steps
- Immediate Response: Remove the SIDHistory backdoor from "j.arnold" immediately; revoke svc-backup-admin's replication ACLs; isolate SRV-APP-071 for forensic imaging; audit all delegated "Replicating Directory Changes" grants domain-wide for unauthorized additions.
- Detection: Sigma-style rule:
title: DCShadow - Non-DC Source Registers NTDS-DSA Object→selection: EventID=4662 AND Object_Type="nTDSDSA" AND Client_Address not in DC_IP_List. - Pro Tip: Alert on DRSUAPI traffic sourced from any IP outside the known DC list - this single network-layer control catches DCShadow regardless of which directory attribute the attacker ultimately modifies.
Hypothesis confirmed - an attacker with stolen replication rights used a rogue domain controller registration to plant a SIDHistory backdoor while evading standard directory-change auditing!