A domain controller shadow (DCShadow) attack is an attack designed to change directory objects using malicious replication. This attack can be performed from any machine by creating a rogue domain controller using a replication process.
DCShadow uses RPC and LDAP to:
Register the machine account as a domain controller (using domain admin rights), and
Perform replication (using the granted replication rights) over DRSUAPI and send changes to directory objects.
Azure ATP detects the attack by 2 security alerts: