Why Most Organizations Still Can’t Defend Against DCShadow – Part 2

Why SIEMs alone can't secure AD monitoring: attackers bypass AD logs (DCShadow), and SIEMs face collection limits, configuration errors, processing gaps, stale threat intel, and false positives.

Why some AD attacks leave no trace: DCShadow injects changes through the replication stream, malicious GPO edits like Ryuk's lack log detail, and ZeroLogon used crafted Netlogon messages—so SIEM-only monitoring misses them.

Semperis research on spotting DCShadow—the Mimikatz technique that impersonates a domain controller to inject stealthy changes into AD—moves from 'how' to 'from where', helping identify the rogue hosts used for hidden persistence.

How DCShadow works: any Windows server can impersonate a domain controller and inject changes into AD's replication stream—bypassing security event logs, with no patch to close the technique.

Lessons from NetSPI's cloud attack simulations: default cloud logging alone is insufficient, SIEM rules need tuning, and breach and attack simulation (BAS) helps validate detective controls in Azure.

Releases Invoke-DCSync, a PowerShell wrapper around Mimikatz's DCSync feature that impersonates a domain controller to dump account hashes without touching the DC.