creating and deleting a server object within 30 seconds or less is unusual but not impossible in a production environment. filter as needed.

Techniques

T1207

Sample rules

Windows AD Short Lived Server Object

source: splunk
technicques:
- T1207

Description

The following analytic identifies the creation and quick deletion of a Domain Controller (DC) object within 30 seconds in an Active Directory environment, indicative of a potential DCShadow attack. This detection leverages Windows Security Event Codes 5137 and 5141, analyzing the duration between these events. This activity is significant as DCShadow allows attackers with privileged access to register a rogue DC, enabling unauthorized changes to AD objects, including credentials. If confirmed malicious, this could lead to unauthorized AD modifications, compromising the integrity and security of the entire domain.

Detection logic

`wineventlog_security` EventCode=5137 OR EventCode=5141 ObjectDN="*CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration*" 
| transaction ObjectDN startswith=(EventCode=5137) endswith=(EventCode=5141) 
| eval short_lived=case((duration<30),"TRUE") 
| search short_lived = TRUE 
| stats values(ObjectDN) values(signature) values(EventCode) by _time, Computer, SubjectUserName 
| `windows_ad_short_lived_server_object_filter`