Windows Security Event DCShadow Indicators via New Service Principal Name GC/
Flags Windows Security events where a servicePrincipalName starting with "GC/" is created, consistent with DCShadow-style SPN registration.
- Product
- windows
- Service
- security
- Author
- Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah (SigmaHQ), DRL 1.1
- Published
- 2019-10-25
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags potential DCShadow activity by looking for new or modified service principal name (SPN) entries that start with "GC/". An attacker using DCShadow techniques may create SPNs to influence how Directory Service components authenticate or interact. The detection relies on Windows Security logs for SPN-related changes, specifically Event ID 4742 and Event IDs 5136/5137/5138/5139/5141 with LDAP attribute servicePrincipalName containing values beginning with "GC/".
Reporting behind it
- twitter.comhttps://twitter.com/gentilkiwi/status/1003236624925413376
- gist.github.comhttps://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
- web.archive.orghttps://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_possible_dc_shadow.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Security Event DCShadow Indicators via New Service Principal Name GC/
id: 85ef1319-17ba-49d5-a2db-612aa206df8e
related:
- id: 611eab06-a145-4dfa-a295-3ccc5c20f59a
type: derived
- id: 32e19d25-4aed-4860-a55a-be99cb0bf7ed
type: derived
status: test
description: This rule flags potential DCShadow activity by looking for new or modified service principal name (SPN) entries that start with "GC/". An attacker using DCShadow techniques may create SPNs to influence how Directory Service components authenticate or interact. The detection relies on Windows Security logs for SPN-related changes, specifically Event ID 4742 and Event IDs 5136/5137/5138/5139/5141 with LDAP attribute servicePrincipalName containing values beginning with "GC/".
references:
- https://twitter.com/gentilkiwi/status/1003236624925413376
- https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
- https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_possible_dc_shadow.yml
author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah, Huntrule Team
date: 2019-10-25
modified: 2022-10-17
tags:
- attack.credential-access
- attack.defense-impairment
- attack.t1207
logsource:
product: windows
service: security
definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
selection1:
EventID: 4742
ServicePrincipalNames|contains: GC/
selection2:
EventID: 5136
AttributeLDAPDisplayName: servicePrincipalName
AttributeValue|startswith: GC/
condition: 1 of selection*
falsepositives:
- Valid on domain controllers; exclude known DCs
level: medium
license: DRL-1.1