mukul975/detecting-dcsync-attack-in-active-directory
skills/detecting-dcsync-attack-in-active-directory/SKILL.md
Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.
$ install --global
skillsauthnpx skillsauth add mukul975/cyber-skills detecting-dcsync-attack-in-active-directoryInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 6, 2026, 3:03 AM234.8s7 files scanned
SKILL.md
- name:
- detecting-dcsync-attack-in-active-directory
- description:
- Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.
- domain:
- cybersecurity
- subdomain:
- threat-hunting
- version:
- 1.0
- author:
- mahipal
- license:
- Apache-2.0
Detecting DCSync Attack in Active Directory
When to Use
- When hunting for credential theft in Active Directory environments
- After compromise of accounts with Replicating Directory Changes permissions
- When investigating suspected use of Mimikatz or Impacket secretsdump
- During incident response involving lateral movement with domain admin credentials
- When auditing AD replication permissions as part of security hardening
Prerequisites
- Windows Security Event Logs with Event ID 4662 (Object Access) enabled
- Advanced Audit Policy: Audit Directory Service Access enabled
- Domain Controller event forwarding to SIEM
- Knowledge of legitimate domain controller hostnames and IPs
- Directory Service Access auditing with SACL on domain object
Workflow
- Identify Legitimate Replication Sources: Document all domain controllers in the environment by hostname, IP, and computer account. Only these should perform directory replication.
- Enable Required Auditing: Configure Advanced Audit Policy to capture Event ID 4662 on domain controllers with specific GUID monitoring for replication rights.
- Monitor Replication Rights Access: Track access to three critical GUIDs -- DS-Replication-Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2), DS-Replication-Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2), and DS-Replication-Get-Changes-In-Filtered-Set (89e95b76-444d-4c62-991a-0facbeda640c).
- Detect Non-DC Replication Requests: Alert when any account NOT associated with a domain controller requests replication rights.
- Correlate with Network Traffic: DCSync generates replication traffic (MS-DRSR/RPC) from the attacker's machine to the DC. Monitor for DrsGetNCChanges RPC calls from non-DC IP addresses.
- Investigate Source Context: Examine the process, user account, and machine originating the replication request.
- Check for Credential Abuse: After DCSync detection, audit for subsequent use of extracted hashes (pass-the-hash, golden ticket creation).
Key Concepts
| Concept | Description | |---------|-------------| | T1003.006 | OS Credential Dumping: DCSync | | DCSync | Mimicking domain controller replication to extract credentials | | DsGetNCChanges | RPC function used to request AD replication data | | DS-Replication-Get-Changes | AD permission required (GUID: 1131f6aa-...) | | DS-Replication-Get-Changes-All | Permission including confidential attributes (GUID: 1131f6ad-...) | | MS-DRSR | Microsoft Directory Replication Service Remote Protocol | | KRBTGT Hash | Key target of DCSync enabling Golden Ticket attacks | | Event ID 4662 | Directory service object access audit event |
Tools & Systems
| Tool | Purpose | |------|---------| | Mimikatz (lsadump::dcsync) | Primary DCSync attack tool | | Impacket secretsdump.py | Python-based DCSync implementation | | DSInternals | PowerShell module for AD replication | | BloodHound | Map accounts with replication rights | | Splunk / Elastic | SIEM correlation of 4662 events | | Microsoft Defender for Identity | Native DCSync detection | | CrowdStrike Falcon | EDR-based DCSync detection |
Detection Queries
Splunk -- DCSync Detection via Event 4662
index=wineventlog EventCode=4662
| where Properties IN ("*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*",
"*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*",
"*89e95b76-444d-4c62-991a-0facbeda640c*")
| where NOT match(SubjectUserName, ".*\\$$")
| where NOT SubjectUserName IN ("known_svc_account1", "known_svc_account2")
| stats count values(Properties) as ReplicationRights by SubjectUserName SubjectDomainName Computer
| where count > 0
| table SubjectUserName SubjectDomainName Computer count ReplicationRights
KQL -- Microsoft Sentinel DCSync Detection
SecurityEvent
| where EventID == 4662
| where Properties has "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
or Properties has "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
| where SubjectUserName !endswith "$"
| where SubjectUserName !in ("AzureADConnect", "MSOL_*")
| project TimeGenerated, SubjectUserName, SubjectDomainName, Computer, Properties
| sort by TimeGenerated desc
Sigma Rule -- DCSync Activity
title: DCSync Activity Detected - Non-DC Replication Request
status: stable
logsource:
product: windows
service: security
detection:
selection:
EventID: 4662
Properties|contains:
- '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'
- '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'
filter_dc:
SubjectUserName|endswith: '$'
condition: selection and not filter_dc
level: critical
tags:
- attack.credential_access
- attack.t1003.006
Common Scenarios
- Mimikatz DCSync: Attacker with Domain Admin privileges runs
lsadump::dcsync /user:krbtgtto extract KRBTGT hash for Golden Ticket creation. - Impacket secretsdump: Remote DCSync via
secretsdump.py domain/user:password@dc-ipextracting all domain hashes. - Delegated Replication Rights: Attacker grants themselves Replicating Directory Changes rights via ACL modification before performing DCSync.
- Azure AD Connect Abuse: Compromising the Azure AD Connect service account which has legitimate replication rights.
- DSInternals PowerShell: Using
Get-ADReplAccountcmdlet to replicate specific account credentials.
Output Format
Hunt ID: TH-DCSYNC-[DATE]-[SEQ]
Alert Severity: Critical
Source Account: [Account requesting replication]
Source Machine: [Hostname/IP of requestor]
Target DC: [Domain controller receiving request]
Replication Rights: [GUIDs accessed]
Timestamp: [Event time]
Legitimate DC: [Yes/No]
Known Service Account: [Yes/No]
Risk Assessment: [Critical - non-DC replication detected]
Related Skills
mukul975/detecting-pass-the-hash-attacks
development
VerifiedTrustedCommunity
Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping indicators. Use when threat hunting for lateral movement via stolen NTLM hashes, triaging EDR/SIEM alerts on suspicious NTLM logons, scoping compromise during incident response, or validating detection coverage in a purple team exercise.
31,851SKILL.mdUpdated Sep 1, 2026
mukul975/detecting-oauth-token-theft
testing
VerifiedTrustedCommunity
Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies. Use for impossible-travel or anomalous token-usage alerts, suspected session hijacking, sign-in log analysis, or configuring token-binding defenses in Azure/M365.
31,851SKILL.mdUpdated Sep 1, 2026
mukul975/detecting-ntlm-relay-with-event-correlation
development
VerifiedTrustedCommunity
Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB/LDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam/DFSCoerce/PrinterBug alerts.
31,851SKILL.mdUpdated Sep 1, 2026
mukul975/detecting-network-scanning-with-ids-signatures
data-ai
VerifiedTrustedCommunity
Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.
31,851SKILL.mdUpdated Sep 1, 2026