Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

New Research: Detecting DCShadow on Rogue Hosts

semperis.com | blog | #active-directory | #detection | #research | #mimikatz | #persistence | #dcshadow

Summary

Semperis research on spotting DCShadow—the Mimikatz technique that impersonates a domain controller to inject stealthy changes into AD—moves from 'how' to 'from where', helping identify the rogue hosts used for hidden persistence.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Why Most Organizations Still Can’t Defend against DCShadow
How DCShadow works: any Windows server can impersonate a domain controller and inject changes into AD's replication stream—bypassing security event logs, with no patch to close the technique.
blog · semperis.com
Why Most Organizations Still Can’t Defend Against DCShadow – Part 2
Defending against DCShadow (part 2): test in isolated labs, watch privileged access, and alert on transient server objects under CN=Sites,CN=Configuration—registration artifacts it leaves behind.
blog · netspi.com
Attacking SQL Server CLR Assemblies
Demonstrates creating, importing, exporting, and altering SQL Server CLR assemblies to execute OS commands, escalate to sysadmin, and persist, with new PowerUpSQL functions for AD-wide campaigns.
blog · netspi.com
Maintaining Persistence via SQL Server – Part 2: Triggers
Shows how DDL, DML, and logon triggers in SQL Server can be abused for persistence, provides a lab and detection guidance, and adds Get-SQLPersistTriggerDDL to PowerUpSQL.
blog · netspi.com
Maintaining Persistence via SQL Server – Part 1: Startup Stored Procedures
Explains why SQL Server is an overlooked persistence layer, covering startup stored procedures that execute at service start, their detection, code review, removal, and PowerUpSQL automation.
blog · netspi.com
Hashdump without the DC using DCSync (because we all wanted it)
Releases Invoke-DCSync, a PowerShell wrapper around Mimikatz's DCSync feature that impersonates a domain controller to dump account hashes without touching the DC.
back