Detection: Windows AD Rogue Domain Controller Network Activity

EXPERIMENTAL DETECTION

This detection status is set to experimental. The Splunk Threat Research team has not yet fully tested, simulated, or built comprehensive datasets for this detection. As such, this analytic is not officially supported. If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2025-05-02 ID: c4aeeeef-da7f-4338-b3ba-553cbcbe2138 Author: Dean Luxton Type: TTP Product: Splunk Enterprise Security

Description

The following analytic identifies unauthorized replication RPC calls from non-domain controller devices. It leverages Zeek wire data to detect specific RPC operations like DrsReplicaAdd and DRSGetNCChanges, filtering out legitimate domain controllers. This activity is significant as it may indicate an attempt to introduce a rogue domain controller, which can compromise the integrity of the Active Directory environment. If confirmed malicious, this could allow attackers to manipulate directory data, escalate privileges, and persist within the network, posing a severe security risk.

1`zeek_rpc` DrsReplicaAdd OR DRSGetNCChanges 
2| where NOT (dest_category="Domain Controller") OR NOT (src_category="Domain Controller") 
3| fillnull value="Unknown" src_category, dest_category 
4| table _time endpoint operation src src_category dest dest_category 
5| `windows_ad_rogue_domain_controller_network_activity_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name Value
zeek_rpc sourcetype="zeek:rpc:json"
windows_ad_rogue_domain_controller_network_activity_filter search *
windows_ad_rogue_domain_controller_network_activity_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1207 Rogue Domain Controller Defense Evasion
Exploitation
DE.CM
CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Notable Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Risk Event True
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

Run zeek on domain controllers to capture the DCE RPC calls, ensure the domain controller categories are defined in Assets and Identities.

Known False Positives

None.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

Rogue DC Activity Detected from $src_category$ device $src$ to $dest$ ($dest_category$)

Risk Object Risk Object Type Risk Score Threat Objects
dest system 100 src

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation Not Applicable N/A N/A N/A
Unit ❌ Failing N/A N/A N/A
Integration ❌ Failing N/A N/A N/A

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 5