T1207 — Rogue Domain Controller

Tactic: Defense Impairment · Platforms: Windows

Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive…

Sigma detection rules (1)

T1207 Rogue Domain Controller

title: T1207 Rogue Domain Controller
id: f18b4e76-6332-4444-a860-3e5a01bc00ec
description: 'Detection Strategy for Rogue Domain Controller (DCShadow) Registration and Replication Abuse. (Data Component: Active Directory Object Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, AllowedReplicationPartners, SuspiciousSPNs, NonDCObjectCreationAlert.'
references:
  - https://attack.mitre.org/techniques/T1207
author: Shahrukh Khan
date: 2026-06-08
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1207

logsource:
  product: windows

detection:
  selection:
    EventID: '4928'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

Explore