LoFP LoFP / valid on domain controllers; exclude known dcs

Techniques

Sample rules

Possible DC Shadow Attack

Description

Detects DCShadow via create new SPN

Detection logic

condition: 1 of selection*
selection1:
  EventID: 4742
  ServicePrincipalNames|contains: GC/
selection2:
  AttributeLDAPDisplayName: servicePrincipalName
  AttributeValue|startswith: GC/
  EventID: 5136