DCShadow

This record covers the cited DCShadow/Mimikatz example: temporarily registering or using a rogue domain-controller identity to simulate directory replication and change Active Directory attributes (the source example stages SIDHistory; the mechanism can affect broader directory objects and schemas). MITRE ATT&CK T1207 currently uses the Rogue Domain Controller name and the Defense Impairment tactic, while also describing SID-history and backdoor uses for Persistence. This catalog record retains the custom Persistence phase because its cited example is explicitly persistence-oriented; the repository's custom phase set has no Defense Impairment value. The cited example requires a Windows session and Domain Admin or equivalent rights; broader registration prerequisites vary with existing rights and registration state. Removing temporary registration artifacts does not itself roll back an already replicated directory change.