---
id: 6014
title: "New Research: Detecting DCShadow on Rogue Hosts"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/new-research-detecting-dcshadow-on-rogue-hosts/"
published_at: "2020-11-16T15:40:52Z"
tags: ["active-directory", "detection", "research", "mimikatz", "persistence", "dcshadow"]
phying_url: "https://phying.com/item/6014"
lang: en
---

# New Research: Detecting DCShadow on Rogue Hosts

## Summary

Semperis research on spotting DCShadow—the Mimikatz technique that impersonates a domain controller to inject stealthy changes into AD—moves from 'how' to 'from where', helping identify the rogue hosts used for hidden persistence.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2020-11-16T15:40:52Z
- **Original:** https://www.semperis.com/blog/new-research-detecting-dcshadow-on-rogue-hosts/
- **Phying News:** https://phying.com/item/6014