Why Most Organizations Still Can’t Defend against DCShadow

Semperis research on spotting DCShadow—the Mimikatz technique that impersonates a domain controller to inject stealthy changes into AD—moves from 'how' to 'from where', helping identify the rogue hosts used for hidden persistence.

Defending against DCShadow (part 2): test in isolated labs, watch privileged access, and alert on transient server objects under CN=Sites,CN=Configuration—registration artifacts it leaves behind.

Custom PowerShell modules and Python packages in Azure Automation Accounts can be backdoored for persistence. NetSPI demonstrates the attack and ships a tool to audit custom modules.

Demonstrates creating, importing, exporting, and altering SQL Server CLR assemblies to execute OS commands, escalate to sysadmin, and persist, with new PowerUpSQL functions for AD-wide campaigns.

Releases Invoke-DCSync, a PowerShell wrapper around Mimikatz's DCSync feature that impersonates a domain controller to dump account hashes without touching the DC.

Introduces Invoke-MassMimikatz-PsRemoting, which combines SPN discovery, PowerShell Remoting, and Invoke-Mimikatz to harvest credentials from many domain systems automatically.