Loading story…
Security researchers detailed how the DCShadow technique allows an attacker with Domain Admin or Enterprise Admin privileges to register a rogue Domain Controller and push unauthorized changes into Active Directory through normal-looking replication. The attack is commonly carried out with Mimikatz, specifically the lsadump::dcshadow capability, and can be used to alter sensitive directory attributes such as primaryGroupID, effectively granting elevated access while making the change appear to come from legitimate replication activity.
The reporting warns that DCShadow can evade traditional logging and SIEM visibility because replication-based changes may not be recorded like standard administrative actions, and attackers may also tamper with replication metadata. Recommended defenses include validating legitimate Domain Controllers and AD objects, monitoring DRS replication events 4928 and 4929, inspecting replication traffic, and watching for suspicious SPN registrations or use of tools associated with Mimikatz.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
The DCShadow attack flow was demonstrated at BlueHat IL 2018 by Vincent Le Toux and Benjamin Delpy. The technique showed how a rogue Domain Controller could be registered and used to inject malicious Active Directory replication changes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcembsd.jp
Open sourcedcshadow.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are abusing Microsoft Volume Shadow Copy Service (VSS) to impair recovery ahead of ransomware deployment and to access copied `NTDS.dIT` data containing Active Directory credentials. In a Huntress investigation, PsExec-launched SYSTEM shells on a domain controller were followed by RDP-session enumeration, creation of VSS shadow copies, and an attempted deletion of the newly created copies; endpoint antivirus blocked the deletion attempt. The activity also included DNS enumeration and reconnaissance against another host, supporting an assessment of lateral movement and credential-access operations. VSS creation or deletion alone is not a reliable alert because backup, RMM, and administrative products commonly use the service; defenders should correlate VSS events with process lineage, privileged remote execution, reconnaissance, credential harvesting, and event timing.
Sep 15, 2026
Huntress disclosed **"dMSA Ouroboros,"** a technique that abuses delegated Managed Service Accounts (dMSAs) in fully patched **Windows Server 2025** to create self-sustaining persistence and repeatedly extract credentials. The method chains delegated `CreateChild` and `WriteProperty` permissions with object ownership, **Shadow Credentials** stored in `msDS-KeyCredentialLink`, and self-referential `msDS-GroupMSAMembership` entries so a rogue dMSA can authenticate and authorize itself to recover the superseded account's **NT hash**. The researchers said the approach builds on Akamai's **BadSuccessor** work and differs from Semperis's **Golden dMSA** research by focusing on post-creation abuse paths. According to the report, the attack survives password rotation, can persist even after the original attacker account is deleted, and may prevent **Domain Admins** from fully remediating the compromise unless the malicious dMSA object itself is removed. Huntress said Microsoft's patch for **`CVE-2025-53779`** did not address this abuse path and that Microsoft classified the issue as a persistence mechanism rather than an elevation-of-privilege flaw, declining to issue a further fix. The firm urged defenders to audit delegated `CreateChild` rights, monitor dMSA creation by non-admin users, and hunt for suspicious `msDS-KeyCredentialLink` values and self-SID entries in `msDS-GroupMSAMembership` on dMSA objects.
Jun 29, 2026
Incident response findings and large-scale Active Directory assessments show that attackers can often escalate from a low-privileged account to **full domain compromise** by chaining common identity weaknesses. Microsoft reported repeated cases of "total identity compromise" tied to excessive privilege, weak password policies, poor credential hygiene, insecure delegation, ACL abuse, Group Policy abuse, trust relationship weaknesses, and exposure of other Tier 0 assets. Separate analysis of 250 PingCastle reports found the same patterns at scale, including delegable administrator accounts, Kerberoast exposure, weak Kerberos encryption, dangerous Group Policy assignments, and exploitable Print Spooler configurations on domain controllers. The assessments also highlighted persistent weaknesses in **Active Directory Certificate Services (AD CS)** and service account management. Research on **Certified Pre-Owned** and AD CS hardening showed that certificate template and enrollment misconfigurations can let attackers impersonate privileged users and gain durable access, while DFIR reporting found widespread service accounts with non-expiring passwords, excessive privileges, and Kerberoastable administrator accounts. Microsoft guidance points defenders toward continuous AD auditing with tools such as Defender for Identity, BloodHound, and PingCastle, along with privilege reduction, stronger authentication, hardened delegation and trust settings, and tighter governance of managed and legacy service accounts to close common escalation paths.
Aug 1, 2026