---
id: 5996
title: "How to Defend Against Active Directory Attacks That Leave No Trace"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/how-to-defend-against-active-directory-attacks-that-leave-no-trace/"
published_at: "2021-04-01T06:27:55Z"
tags: ["siem", "active-directory", "detection", "group-policy", "zerologon", "dcshadow"]
phying_url: "https://phying.com/item/5996"
lang: en
---

# How to Defend Against Active Directory Attacks That Leave No Trace

## Summary

Why some AD attacks leave no trace: DCShadow injects changes through the replication stream, malicious GPO edits like Ryuk's lack log detail, and ZeroLogon used crafted Netlogon messages—so SIEM-only monitoring misses them.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2021-04-01T06:27:55Z
- **Original:** https://www.semperis.com/blog/how-to-defend-against-active-directory-attacks-that-leave-no-trace/
- **Phying News:** https://phying.com/item/5996