---
id: 6033
title: "Why Most Organizations Still Can’t Defend Against DCShadow – Part 2"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/why-most-organizations-still-cant-defend-against-dcshadow-part-2/"
published_at: "2019-08-26T19:55:36Z"
tags: ["siem", "active-directory", "detection", "mimikatz", "privileged-access", "dcshadow"]
phying_url: "https://phying.com/item/6033"
lang: en
---

# Why Most Organizations Still Can’t Defend Against DCShadow – Part 2

## Summary

Defending against DCShadow (part 2): test in isolated labs, watch privileged access, and alert on transient server objects under CN=Sites,CN=Configuration—registration artifacts it leaves behind.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2019-08-26T19:55:36Z
- **Original:** https://www.semperis.com/blog/why-most-organizations-still-cant-defend-against-dcshadow-part-2/
- **Phying News:** https://phying.com/item/6033