DCShadow

DCShadow is another late-stage kill chain attack that allows an attacker with privileged credentials to register a rogue domain controller in order to push arbitrary changes to a domain via domain replication (for example applying forbidden sidHistory values).

Name: DCShadow

Codename: I-DCShadow

Severity: Critical