A DCShadow attack abuses Active Directory replication to inject changes as if they came from a legitimate domain controller. With sufficient rights the attacker temporarily registers a rogue DC, pushes changes (adding SIDHistory, granting DCSync rights, editing group membership), and normal replication distributes them to the real DCs. Because the change does not go through a normal admin action, most auditing misses it, which makes it a stealthy persistence and privilege technique. Defend by restricting replication rights and monitoring for unexpected DC registrations.
What a DCShadow attack is
Domain controllers trust each other to replicate directory changes. DCShadow abuses that trust: the attacker briefly registers their machine as a domain controller in the configuration partition, then uses replication to push arbitrary changes into AD. The changes look like routine replication traffic, so the usual audit trail on object modifications does not fire.
How the attack works
With Domain Admin (or equivalent replication rights) the attacker runs mimikatz lsadump::dcshadow to register a temporary DC and stage changes, then lsadump::dcshadow /push to replicate them. Common payloads are adding SIDHistory of a privileged group to an attacker account, granting DCSync rights on the domain object, or editing primaryGroupID. Once pushed, the rogue DC object is removed, leaving the malicious change behind. Payloads are shown for defensive testing.
How to defend against it
Treat replication rights (Replicating Directory Changes) as tier-0 and grant them to as few principals as possible. Monitor the configuration partition for new nTDSDSA (DC) objects and for replication from unexpected sources, and alert on SIDHistory and DACL changes on privileged objects. Detecting the short-lived DC registration is the most reliable signal, since the pushed change itself is quiet.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: Active Directory replication concepts(Microsoft)
If replication rights are loosely held, a DCShadow attack can rewrite your directory quietly. Talk to a security expert about testing your tier-0 exposure.