Windows Security: Detect DCShadow-like SPN Creation (GC/ Service Principal Names)

Flags Windows Security events where a servicePrincipalName starting with "GC/" is created, consistent with DCShadow-style SPN registration.

FreeUnreviewedSigmamediumv1

windows-security-detect-dcshadow-like-spn-creation-gc-service-principal-names-32e19d25

title: "Windows Security: Detect DCShadow-like SPN Creation (GC/ Service Principal Names)"
id: 85ef1319-17ba-49d5-a2db-612aa206df8e
related:
  - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a
    type: derived
  - id: 32e19d25-4aed-4860-a55a-be99cb0bf7ed
    type: derived
status: test
description: This rule identifies Windows domain events where servicePrincipalName values that begin with "GC/" are created, a behavior consistent with DCShadow attempts to register rogue GC-related SPNs. An attacker may use this technique to impair or mislead directory services by introducing unauthorized service identities. It relies on Security log telemetry for Event ID 4742 and Event ID 5136, specifically the presence of "GC/" in ServicePrincipalNames and the LDAP display name for servicePrincipalName.
references:
  - https://twitter.com/gentilkiwi/status/1003236624925413376
  - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
  - https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_possible_dc_shadow.yml
author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah, Huntrule Team
date: 2019-10-25
modified: 2022-10-17
tags:
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1207
logsource:
  product: windows
  service: security
  definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
  selection1:
    EventID: 4742
    ServicePrincipalNames|contains: GC/
  selection2:
    EventID: 5136
    AttributeLDAPDisplayName: servicePrincipalName
    AttributeValue|startswith: GC/
  condition: 1 of selection*
falsepositives:
  - Valid on domain controllers; exclude known DCs
level: medium
license: DRL-1.1

What it detects

This rule identifies Windows domain events where servicePrincipalName values that begin with "GC/" are created, a behavior consistent with DCShadow attempts to register rogue GC-related SPNs. An attacker may use this technique to impair or mislead directory services by introducing unauthorized service identities. It relies on Security log telemetry for Event ID 4742 and Event ID 5136, specifically the presence of "GC/" in ServicePrincipalNames and the LDAP display name for servicePrincipalName.

Known false positives

Valid on domain controllers; exclude known DCs

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.