DCshadow - Rogue Domain Controller Registration
Detects modifications to a computer account (Event ID 4742) that involve the addition or modification of Service Principal Names (SPNs) containing sensitive strings such as 'GC/' (Global Catalog), 'DRS' (Directory Replication Service), or specific GUIDs. These activities are often associated with techniques to facilitate Kerberoasting, domain trust exploitation, or unauthorized service manipulation.
Microsoft Sentinel (KQL)
