Possible DC Shadow Attack (via security)

title: Possible DC Shadow Attack (via security)
id: 60a7a417-ba6f-5160-b649-dc094de679be
status: stable
description: This rule detects DCShadow via create new SPN
references:
    - https://attack.mitre.org/techniques/T1207/
    - https://twitter.com/gentilkiwi/status/1003236624925413376
    - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
    - https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
author: Huntrule Team
date: 2026-07-21
tags:
    - attack.credential-access
    - attack.defense-impairment
    - attack.t1207
logsource:
    product: windows
    service: security
    definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
    selection1:
        EventID: 4742
        ServicePrincipalNames|contains: 'GC/'
    selection2:
        EventID: 5136
        AttributeLDAPDisplayName: servicePrincipalName
        AttributeValue|startswith: 'GC/'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: medium