DCShadow Explained - A Technical Deep Dive into the New AD Attack

On January 24, 2018, security researchers Benjamin Delpy and Vincent Le Toux announced a new attack technique targeting Active Directory at the BlueHat IL security conference. Named DCShadow, this attack allows an attacker with certain rights to create a rogue domain controller and replicate malicious objects in an AD infrastructure. Here, we’ll explain the technical foundations of the attack, its impact on Active Directory security, and how blue teams can detect it.