Cross-source coverage
T1003.006 / ATT&CK
OS Credential Dumping: DCSync
15 rules across 3 sources.
From MITRE ATT&CK 19.2
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.
Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a Golden Ticket for use in Pass the Ticket or change an account's password as noted in Account Manipulation.
DCSync functionality has been included in the "lsadump" module in Mimikatz. Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.
- Tactics
- Credential Access
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityNSM:Content
How MITRE says to detect it DET0594
Detection of Unauthorized DCSync Operations via Replication API Abuse
Windows Analytic 1632
Detects unauthorized invocation of replication operations (DCSync) via Directory Replication Service (DRS), often executed by threat actors using Mimikatz or similar tools from non-DC endpoints.
WinEventLog:SecurityEventCode=4662WinEventLog:SecurityEventCode=4929NSM:ContentTraffic on RPC DRSUAPI
SigmaHQ/sigma
7 rules| Detection | Severity | Format |
|---|---|---|
| Credential Dumping Tools Service Execution - Security | High | Sigma |
| Credential Dumping Tools Service Execution - System | High | Sigma |
| HackTool - Mimikatz Execution | High | Sigma |
| Mimikatz Use | High | Sigma |
| Active Directory Replication from Non Machine Account - DcSync Indicator | Medium | Sigma |
| Suspicious Get-ADReplAccount | Medium | Sigma |
| Suspicious Machine Account Replication - DcSync Indicator | Medium | Sigma |
elastic/detection-rules
5 rules| Detection | Severity | Format |
|---|---|---|
| Potential Invoke-Mimikatz PowerShell Script | Critical | Elastic TOML |
| First Time Seen Account Performing DCSync | High | Elastic TOML |
| Potential Active Directory Replication Account Backdoor | Medium | Elastic TOML |
| Potential Credential Access via DCSync | Medium | Elastic TOML |
| Potential PowerShell HackTool Script by Function Names | Medium | Elastic TOML |
splunk/security_content
3 rules| Detection | Severity | Format |
|---|---|---|
| Windows AD Replication Request Initiated by User Account | Undefined | SPL |
| Windows AD Replication Request Initiated from Unsanctioned Location | Undefined | SPL |
| Windows AD Replication Service Traffic | Undefined | SPL |