---
id: 6034
title: "Why Most Organizations Still Can’t Defend against DCShadow"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/why-most-organizations-still-cant-defend-against-dcshadow/"
published_at: "2019-07-16T19:15:01Z"
tags: ["active-directory", "backdoor", "mimikatz", "persistence", "dcshadow", "event-logging"]
phying_url: "https://phying.com/item/6034"
lang: en
---

# Why Most Organizations Still Can’t Defend against DCShadow

## Summary

How DCShadow works: any Windows server can impersonate a domain controller and inject changes into AD's replication stream—bypassing security event logs, with no patch to close the technique.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2019-07-16T19:15:01Z
- **Original:** https://www.semperis.com/blog/why-most-organizations-still-cant-defend-against-dcshadow/
- **Phying News:** https://phying.com/item/6034