Sigma rule: DC Machine Account Network Logon from Non-DC Source IP

Rule

Title

DC Machine Account Network Logon from Non-DC Source IP

Status

experimental

Level

critical

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-07-29

File

rules-placeholder/windows/builtin/security/win_security_dc_machine_account_logon_non_dc_ip.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a Domain Controller machine account authenticating from a source IP that is not
a known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during
replication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and
indicates one of the following:

- Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without
requesting a TGT
- Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from
a non-DC host
- Overpass-the-Hash: attacker converted a stolen DC machine account hash into a
Kerberos ticket and is authenticating from a non-DC host
- Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost):
attacker obtained a DC certificate via ADCS CDC-chase
abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync

Log source

product

windows

service

security

Detection

selection:
    EventID: 4624
    TargetUserName|endswith: '$'
    TargetUserName|expand: '%dc_machine_accounts%'
filter_main_dc_source:
    IpAddress|expand: '%dc_ip_addresses%'
filter_main_loopback:
    - IpAddress:
          - '127.0.0.1'
          - '::1'
          - '::ffff:127.0.0.1'
          - '-'
    - IpAddress|startswith: 'fe80:'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unlikely if %dc_machine_accounts% and %dc_ip_addresses% are correctly populated.

Tags

• attack.credential-access
• attack.lateral-movement
• attack.t1550.003
• attack.t1558.002
• attack.t1649
• cve.2026-54121

CVEs this rule names

• CVE-2026-54121

MITRE ATT&CK ids this rule names

• T1550.003
• T1558.002
• T1649

References

• https://github.com/aniqfakhrul/CVE-2026-54121

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-placeholder/windows/builtin/security/win_security_dc_machine_account_logon_non_dc_ip.yml