ATT&CK technique
View on MITRE ATT&CK →
T1207
Rogue Domain Controller
Defense Impairment
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Windows AD DCShadow Privileges ACL Addition | production | 2026-09-22 |
| splunk | Windows AD Domain Controller Promotion | production | 2026-05-13 |
| splunk | Windows AD Short Lived Domain Controller SPN Attribute | production | 2026-05-13 |
| splunk | Windows AD Short Lived Server Object | production | 2026-05-13 |
| splunk | Windows AD Replication Service Traffic | experimental | 2026-05-13 |
| splunk | Windows AD Rogue Domain Controller Network Activity | experimental | 2026-05-13 |
| sigma | Possible DC Shadow Attack | test | 2022-10-17 |
| sigma | Add or Remove Computer from DC | test | 2022-10-14 |