What it does. Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-dcsync-attack-in-active-directory, or copy the skill folder into ~/.claude/skills/detecting-dcsync-attack-in-active-directory/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dcsync-attack-in-active-directory/SKILL.md
SKILL.md (verbatim)
name: detecting-dcsync-attack-in-active-directory
description: Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.
domain: cybersecurity
subdomain: threat-hunting
tags:
- threat-hunting
- active-directory
- dcsync
- credential-theft
- mitre-t1003-006
- mimikatz
- kerberos
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Application Protocol Command Analysis
- Network Isolation
- Network Traffic Analysis
- Client-server Payload Profiling
- Platform Monitoring
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1046
- T1057
- T1082
- T1083
- T1003
Detecting DCSync Attack in Active Directory
When to Use
- When hunting for credential theft in Active Directory environments
- After compromise of accounts with Replicating Directory Changes permissions
- When investigating suspected use of Mimikatz or Impacket secretsdump
- During incident response involving lateral movement with domain admin credentials
- When auditing AD replication permissions as part of security hardening
Prerequisites
- Windows Security Event Logs with Event ID 4662 (Object Access) enabled
- Advanced Audit Policy: Audit Directory Service Access enabled
- Domain Controller event forwarding to SIEM
- Knowledge of legitimate domain controller hostnames and IPs
- Directory Service Access auditing with SACL on domain object
Workflow
- Identify Legitimate Replication Sources: Document all domain controllers in the environment by hostname, IP, and computer account. Only these should perform directory replication.
- Enable Required Auditing: Configure Advanced Audit Policy to capture Event ID 4662 on domain controllers with specific GUID monitoring for replication rights.
- Monitor Replication Rights Access: Track access to three critical GUIDs -- DS-Replication-Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2), DS-Replication-Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2), and DS-Replication-Get-Changes-In-Filtered-Set (89e95b76-444d-4c62-991a-0facbeda640c).
- Detect Non-DC Replication Requests: Alert when any account NOT associated with a domain controller requests replication rights.
- Correlate with Network Traffic: DCSync generates replication traffic (MS-DRSR/RPC) from the attacker's machine to the DC. Monitor for DrsGetNCChanges RPC calls from non-DC IP addresses.
- Investigate Source Context: Examine the process, user account, and machine originating the replication request.
- Check for Credential Abuse: After DCSync detection, audit for subsequent use of extracted hashes (pass-the-hash, golden ticket creation).
Key Concepts
| Concept |
Description |
| T1003.006 |
OS Credential Dumping: DCSync |
| DCSync |
Mimicking domain controller replication to extract credentials |
| DsGetNCChanges |
RPC function used to request AD replication data |
| DS-Replication-Get-Changes |
AD permission required (GUID: 1131f6aa-...) |
| DS-Replication-Get-Changes-All |
Permission including confidential attributes (GUID: 1131f6ad-...) |
| MS-DRSR |
Microsoft Directory Replication Service Remote Protocol |
| KRBTGT Hash |
Key target of DCSync enabling Golden Ticket attacks |
| Event ID 4662 |
Directory service object access audit event |
| Tool |
Purpose |
| Mimikatz (lsadump::dcsync) |
Primary DCSync attack tool |
| Impacket secretsdump.py |
Python-based DCSync implementation |
| DSInternals |
PowerShell module for AD replication |
| BloodHound |
Map accounts with replication rights |
| Splunk / Elastic |
SIEM correlation of 4662 events |
| Microsoft Defender for Identity |
Native DCSync detection |
| CrowdStrike Falcon |
EDR-based DCSync detection |
Detection Queries
Splunk -- DCSync Detection via Event 4662
index=wineventlog EventCode=4662
| where Properties IN ("*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*",
"*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*",
"*89e95b76-444d-4c62-991a-0facbeda640c*")
| where NOT match(SubjectUserName, ".*\\$$")
| where NOT SubjectUserName IN ("known_svc_account1", "known_svc_account2")
| stats count values(Properties) as ReplicationRights by SubjectUserName SubjectDomainName Computer
| where count > 0
| table SubjectUserName SubjectDomainName Computer count ReplicationRights
KQL -- Microsoft Sentinel DCSync Detection
SecurityEvent
| where EventID == 4662
| where Properties has "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
or Properties has "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
| where SubjectUserName !endswith "$"
| where SubjectUserName !in ("AzureADConnect", "MSOL_*")
| project TimeGenerated, SubjectUserName, SubjectDomainName, Computer, Properties
| sort by TimeGenerated desc
Sigma Rule -- DCSync Activity
title: DCSync Activity Detected - Non-DC Replication Request
status: stable
logsource:
product: windows
service: security
detection:
selection:
EventID: 4662
Properties|contains:
- '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'
- '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'
filter_dc:
SubjectUserName|endswith: '$'
condition: selection and not filter_dc
level: critical
tags:
- attack.credential_access
- attack.t1003.006
Common Scenarios
- Mimikatz DCSync: Attacker with Domain Admin privileges runs
lsadump::dcsync /user:krbtgt to extract KRBTGT hash for Golden Ticket creation.
- Impacket secretsdump: Remote DCSync via
secretsdump.py domain/user:password@dc-ip extracting all domain hashes.
- Delegated Replication Rights: Attacker grants themselves Replicating Directory Changes rights via ACL modification before performing DCSync.
- Azure AD Connect Abuse: Compromising the Azure AD Connect service account which has legitimate replication rights.
- DSInternals PowerShell: Using
Get-ADReplAccount cmdlet to replicate specific account credentials.
Hunt ID: TH-DCSYNC-[DATE]-[SEQ]
Alert Severity: Critical
Source Account: [Account requesting replication]
Source Machine: [Hostname/IP of requestor]
Target DC: [Domain controller receiving request]
Replication Rights: [GUIDs accessed]
Timestamp: [Event time]
Legitimate DC: [Yes/No]
Known Service Account: [Yes/No]
Risk Assessment: [Critical - non-DC replication detected]
Other files in this skill
assets/template.md (verbatim)
DCSync Attack Detection Hunt Template
| Field |
Value |
| Hunt ID |
TH-DCSYNC-YYYY-MM-DD-NNN |
| Analyst |
|
| Date |
|
| Status |
[ ] In Progress / [ ] Complete |
Hypothesis
An adversary with elevated AD privileges is performing DCSync to extract password hashes from Active Directory by replicating directory data from a non-domain-controller machine.
Pre-Hunt Checklist
DCSync Detection Findings
| # |
Timestamp |
Subject Account |
Source Machine |
Target DC |
Replication Rights |
Severity |
| 1 |
|
|
|
|
|
|
Accounts with Replication Rights Audit
| Account |
Type |
Rights |
Legitimate |
Justification |
|
User/Service/Computer |
Get-Changes / Get-Changes-All |
Yes/No |
|
Post-DCSync Impact Assessment
| Check |
Status |
Notes |
| KRBTGT hash potentially compromised |
|
|
| Domain Admin hashes extracted |
|
|
| Service account credentials at risk |
|
|
| Golden Ticket creation possible |
|
|
Response Actions
- Disable: [Compromised accounts]
- Reset: [KRBTGT password -- twice, 12 hours apart]
- Revoke: [Unauthorized replication rights]
- Investigate: [Source machine forensics]
- Monitor: [Subsequent credential abuse attempts]
references/api-reference.md (verbatim)
API Reference: Detecting DCSync Attack in Active Directory
DCSync Replication GUIDs
| GUID |
Right |
| 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 |
DS-Replication-Get-Changes |
| 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 |
DS-Replication-Get-Changes-All |
| 89e95b76-444d-4c62-991a-0facbeda640c |
DS-Replication-Get-Changes-In-Filtered-Set |
Windows Event ID 4662 Fields
<EventID>4662</EventID>
<Data Name="SubjectUserName">attacker</Data>
<Data Name="SubjectDomainName">CORP</Data>
<Data Name="Properties">{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}</Data>
<Data Name="ObjectName">DC=corp,DC=local</Data>
python-evtx Usage
import Evtx.Evtx as evtx
with evtx.Evtx("Security.evtx") as log:
for record in log.records():
xml = record.xml()
# Filter for EventID 4662 with replication GUIDs
Splunk SPL Detection Query
index=wineventlog EventCode=4662
| where Properties IN ("*1131f6aa*", "*1131f6ad*", "*89e95b76*")
| where NOT match(SubjectUserName, ".*\\$$")
| stats count values(Properties) by SubjectUserName Computer
KQL (Microsoft Sentinel)
SecurityEvent
| where EventID == 4662
| where Properties has "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
| where SubjectUserName !endswith "$"
| project TimeGenerated, SubjectUserName, Computer, Properties
PowerShell - Audit Replication Permissions
$domain = (Get-ADDomain).DistinguishedName
$acl = Get-Acl "AD:\$domain"
$acl.Access | Where-Object {
$_.ObjectType -in @(
'1131f6aa-9c07-11d1-f79f-00c04fc2dcd2',
'1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'
)
} | Select IdentityReference, ObjectType
| Tool |
Command |
| Mimikatz |
lsadump::dcsync /user:krbtgt /domain:corp.local |
| Impacket |
secretsdump.py corp/admin:pass@dc-ip |
| DSInternals |
Get-ADReplAccount -SamAccountName krbtgt |
CLI Usage
python agent.py --security-log Security.evtx --dc-accounts known_dcs.txt
python agent.py --generate-sigma
python agent.py --check-perms
references/standards.md (verbatim)
Standards and References - DCSync Attack Detection
MITRE ATT&CK Credential Access (TA0006)
| Technique |
Name |
Relevance |
| T1003.006 |
OS Credential Dumping: DCSync |
Primary technique |
| T1003.001 |
LSASS Memory |
Often combined with DCSync for complete credential theft |
| T1003.003 |
NTDS |
Alternative to DCSync using ntdsutil or volume shadow copy |
| T1078.002 |
Valid Accounts: Domain Accounts |
Using dumped credentials |
| T1558.001 |
Steal or Forge Kerberos Tickets: Golden Ticket |
Primary goal of KRBTGT hash extraction |
| T1222.001 |
File and Directory Permissions Modification |
Granting replication rights |
Critical Replication GUIDs
| GUID |
Permission Name |
Risk |
| 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 |
DS-Replication-Get-Changes |
Required for DCSync |
| 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 |
DS-Replication-Get-Changes-All |
Includes confidential attributes (passwords) |
| 89e95b76-444d-4c62-991a-0facbeda640c |
DS-Replication-Get-Changes-In-Filtered-Set |
Partial replication rights |
Windows Event IDs for DCSync Detection
| Event ID |
Source |
Description |
| 4662 |
Security |
Directory Service Object Access (primary detection) |
| 4624 |
Security |
Successful logon (correlate source of replication) |
| 4672 |
Security |
Special privileges assigned (admin logon) |
| 4738 |
Security |
User account changed (permission grants) |
| 5136 |
Security |
Directory Service Object modified (ACL changes) |
Known Threat Actors Using DCSync
| Actor |
Context |
| APT29 (Cozy Bear) |
Used DCSync in SolarWinds campaign |
| FIN6 |
DCSync for credential harvesting in retail/hospitality |
| Wizard Spider |
TrickBot/Conti ransomware using DCSync pre-encryption |
| APT28 (Fancy Bear) |
DCSync in government network intrusions |
| LAPSUS$ |
DCSync after AD compromise for data theft |
Legitimate Replication Sources
| Source |
Reason |
How to Distinguish |
| Domain Controllers |
Normal AD replication |
Computer account ends with $ |
| Azure AD Connect |
Hybrid identity sync |
MSOL_ service account |
| Backup Software |
AD backup operations |
Documented service accounts |
| Migration Tools |
Cross-forest migrations |
Temporary, documented operations |
references/workflows.md (verbatim)
Detailed Hunting Workflow - DCSync Attack Detection
Phase 1: Enumerate Legitimate Replication Accounts
Step 1.1 - List All Domain Controllers
Get-ADDomainController -Filter * | Select-Object Name, IPv4Address, OperatingSystem
Step 1.2 - Find Accounts with Replication Rights
# Find all accounts with Replicating Directory Changes
Import-Module ActiveDirectory
$rootDSE = Get-ADRootDSE
$domainDN = $rootDSE.defaultNamingContext
$acl = Get-Acl "AD:\$domainDN"
$acl.Access | Where-Object {
$_.ObjectType -eq "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" -or
$_.ObjectType -eq "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
} | Select-Object IdentityReference, ActiveDirectoryRights, ObjectType
Step 1.3 - BloodHound Query for DCSync Rights
MATCH p=(n)-[:GetChanges|GetChangesAll]->(d:Domain)
WHERE NOT n:Domain
RETURN n.name, labels(n)
Phase 2: Deploy Detection
Step 2.1 - Enable Required Audit Policy
auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
Step 2.2 - Configure SACL on Domain Object
Apply SACL to the domain root object monitoring for:
- Control Access rights
- Access to Replication GUIDs
- By Everyone or Authenticated Users
Phase 3: Active Monitoring
Step 3.1 - Splunk Real-Time Detection
index=wineventlog source="WinEventLog:Security" EventCode=4662
| rex field=Properties "(?<guid>\{[0-9a-f-]+\})"
| where guid IN ("{1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}",
"{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}",
"{89e95b76-444d-4c62-991a-0facbeda640c}")
| lookup dc_accounts SubjectUserName OUTPUT is_dc
| where is_dc!="true"
| eval alert_severity="CRITICAL"
| table _time SubjectUserName SubjectDomainName Computer guid alert_severity
Step 3.2 - Network-Level Detection
index=zeek sourcetype=dce_rpc
| where operation="DRSGetNCChanges"
| lookup domain_controllers src_ip OUTPUT is_dc
| where is_dc!="true"
| table _time src_ip dst_ip operation
Phase 4: Investigation
Step 4.1 - Determine Source Machine
Correlate Event 4662 with Event 4624 to identify the source workstation:
index=wineventlog EventCode=4624 LogonType=3
| where TargetUserName=[suspected_account]
| table _time TargetUserName IpAddress WorkstationName LogonType
Step 4.2 - Check for Subsequent Credential Abuse
index=wineventlog EventCode=4769
| where ServiceName="krbtgt"
| where TicketEncryptionType="0x17"
| table _time TargetUserName ServiceName IpAddress TicketEncryptionType
Phase 5: Response
- Disable compromised account immediately
- Rotate KRBTGT password (twice, 12 hours apart)
- Reset all service account passwords
- Block source IP at network level
- Isolate source machine for forensics
- Remove unauthorized replication rights
- Review all accounts with DCSync-capable permissions
- Implement tiered administration model
- Enable Microsoft Defender for Identity DCSync alerts
- Deploy Protected Users security group for admin accounts
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.