hunting-for-dcsync-attacks

name	hunting-for-dcsync-attacks
description	Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","dcsync","active-directory","credential-access","t1003.006","mimikatz","windows","dfir"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]
mitre_attack	["T1046","T1057","T1082","T1083","T1003"]

Hunting for DCSync Attacks

When to Use

• When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)
• After detecting Mimikatz or similar tools in the environment
• During incident response involving Active Directory compromise
• When monitoring for unauthorized domain replication requests
• During purple team exercises testing AD attack detection

Prerequisites

• Windows Security Event Log forwarding enabled (Event ID 4662)
• Audit Directory Service Access enabled via Group Policy
• Domain Computers SACL configured on Domain Object for machine account detection
• SIEM with Windows event data ingested (Splunk, Elastic, Sentinel)
• Knowledge of legitimate domain controller accounts and replication partners

Workflow

1. Enable Auditing: Ensure Audit Directory Service Access is enabled on domain controllers.
2. Collect Events: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access).
3. Filter Replication GUIDs: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
4. Identify Non-DC Sources: Flag events where SubjectUserName is not a domain controller machine account.
5. Correlate with Network: Cross-reference source IPs against known DC addresses.
6. Validate Findings: Exclude legitimate replication tools (Azure AD Connect, SCCM).
7. Respond: Disable compromised accounts, reset krbtgt, investigate lateral movement.

Key Concepts

Concept	Description
DCSync	Technique abusing AD replication protocol to extract password hashes
Event ID 4662	Directory Service Access audit event
DS-Replication-Get-Changes	GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
DS-Replication-Get-Changes-All	GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
AccessMask 0x100	Control Access right indicating extended rights verification
T1003.006	OS Credential Dumping: DCSync

Tools & Systems

Tool	Purpose
Windows Event Viewer