domains / families / security / detecting-dcsync-attack-in-active-directory

detecting-dcsync-attack-in-active-directory

separate

Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.

When to use

• When hunting for credential theft in Active Directory environments
• After compromise of accounts with Replicating Directory Changes permissions
• When investigating suspected use of Mimikatz or Impacket secretsdump
• During incident response involving lateral movement with domain admin credentials
• When auditing AD replication permissions as part of security hardening

Skill page

Source