attack.t1207 | Detection.FYI

Add or Remove Computer from DC

Apr 28, 2026 · attack.defense-impairment attack.t1207 ·
Share on:

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Read More
Possible DC Shadow Attack

Apr 28, 2026 · attack.credential-access attack.defense-impairment attack.t1207 ·
Share on:

Detects DCShadow via create new SPN

Read More