Possible DC Shadow Attack via New SPN

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•25

This rule detects potential DCShadow attacks by looking for the creation of new Service Principal Names (SPNs) that contain 'GC/' in either Event ID 4742 (A computer account was changed) or Event ID 5136 (A directory service object was modified). DCShadow is a technique used by adversaries to register a rogue Domain Controller and manipulate Active Directory data.