Skip to content
Threat Feed

Tag

Dcshadow

1 brief RSS
high advisory

Windows AD DCShadow Privilege Escalation via ACL Modification

This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack by modifying permissions on the domainDNS object.

Active Directory +3 dcshadow active_directory acl privilege_escalation persistence
2r 3t