detecting-dcsync-attack-in-active-directory

name	detecting-dcsync-attack-in-active-directory
description	Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","active-directory","dcsync","credential-theft","mitre-t1003-006","mimikatz","kerberos"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Detecting DCSync Attack in Active Directory

When to Use

• When hunting for credential theft in Active Directory environments
• After compromise of accounts with Replicating Directory Changes permissions
• When investigating suspected use of Mimikatz or Impacket secretsdump
• During incident response involving lateral movement with domain admin credentials
• When auditing AD replication permissions as part of security hardening

Detection Gaps & Validation

• No SACL = no 4662. The detection depends entirely on an audit SACL on the domain object covering "Replicating Directory Changes." Without it the DCSync generates zero 4662 events. Verify the SACL on the domain root and that auditpol /get /subcategory:"Directory Service Access" shows Success.
• Properties field gets dropped. Many log pipelines truncate or omit the 4662 Properties field that carries the replication GUIDs (1131f6aa-…, 1131f6ad-…). Confirm your parser preserves it or the query matches nothing.
• Network-only detection for the no-SACL case: DCSync issues DsGetNCChanges over the DRSUAPI RPC interface (MS-DRSR) from the attacker host. Flag DRSUAPI/replication RPC sourced from any non-DC IP — this is what Defender for Identity keys on when 4662 is unavailable.
• Account evasion: filtering only *$ machine accounts misses a DCSync run from a renamed/compromised account that legitimately holds replication rights; also exclude Entra/Azure AD Connect (MSOL_*, AADConnect) explicitly rather than broadly.
• Validate the rule fires: in a lab, run mimikatz lsadump::dcsync /user:krbtgt or DSInternals Get-ADReplAccount and confirm a 4662 with GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 appears for your non-DC account.
• Tune false positives: baseline the real DCs and known replication service accounts, then alert only on SubjectUserName that is non-$ and not on the allowlist.

Prerequisites

• Windows Security Event Logs with Event ID 4662 (Object Access) enabled
• Advanced Audit Policy: Audit Directory Service Access enabled
• Domain Controller event forwarding to SIEM
• Knowledge of legitimate domain controller hostnames and IPs
• Directory Service Access auditing with SACL on domain object