mdecrevoisier high experimental sigma

Account accessed to attributes related to DCshadow

Detects scenarios where an attacker accessed attributes related to DCshadow attack in order to create a fake domain controller.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4662,
    "Properties
| contains": [
      "1131f6ac-9c07-11d1-f79f-00c04fc2dcd2",
      "9923a32a-3607-11d2-b9be-0000f87a36b2"
    ]
  },
  "filter": {
    "SubjectUserName
| endswith": "$"
  },
  "condition": "selection and not filter"
}

False Positives

  • ⚠ new domain controller registration

Field Validations

Loading…

Comments (0)

Loading comments...