skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-dcsync-attack-in-active-directory

Detect DCSync attacks by monitoring Event 4662 for non-DC replication requests.

954|172|Updated Mar 13, 2026
Search Tags:#siem#threat-hunting#mimikatz#Active-Directory#credential-theft#DCSync#event-4662
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-dcsync-attack-in-active-directory
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-dcsync-attack-in-active-directory
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-dcsync-attack-in-active-directory
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-dcsync-attack-in-active-directory

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

DCSync attacks let adversaries abuse Active Directory replication privileges to silently extract password hashes, including the KRBTGT hash used for Golden Ticket attacks. This Skill provides a structured hunting workflow to detect non-domain-controller accounts requesting directory replication before stolen credentials are abused.

Core Features & Use Cases

  • Event 4662 Monitoring: Track access to the three replication GUIDs (DS-Replication-Get-Changes, Get-Changes-All, Get-Changes-In-Filtered-Set) and alert on non-DC accounts.
  • Ready-to-Use Detection Queries: Includes Splunk SPL, Microsoft Sentinel KQL, and a Sigma rule for DCSync detection.
  • Network Correlation: Flags DRSUAPI/DsGetNCChanges RPC traffic from non-DC IP addresses when SACL auditing is unavailable.
  • Use Case: During incident response after a domain admin compromise, run the KQL query in Sentinel to identify any non-DC account that requested replication rights, then investigate for pass-the-hash or Golden Ticket follow-on activity.

Quick Start

Hunt for DCSync attacks in my Active Directory environment by checking Event 4662 logs for replication requests from non-domain-controller accounts.

Frequently Asked Questions about detecting-dcsync-attack-in-active-directory

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect DCSync attacks in Active Directory?▼

Monitor Windows Security Event ID 4662 for access to replication GUIDs 1131f6aa and 1131f6ad, then alert when the requesting account is not a domain controller machine account. Correlate with DRSUAPI RPC network traffic from non-DC IP addresses for additional coverage.

What tools are used to perform DCSync attacks?▼

Mimikatz with lsadump::dcsync is the primary tool, along with Impacket secretsdump.py for remote execution and the DSInternals PowerShell module's Get-ADReplAccount cmdlet. All of them invoke the DsGetNCChanges RPC function over the MS-DRSR protocol.

Why is my DCSync detection rule not generating any alerts?▼

The most common cause is a missing SACL on the domain object covering Replicating Directory Changes, which means no 4662 events are generated at all. Also verify that log pipelines preserve the Properties field containing the replication GUIDs, since many parsers truncate it.

Does DCSync detection work without Event 4662 auditing?▼

Yes, but only via network-based detection. Monitor for DRSUAPI replication RPC calls sourced from non-domain-controller IP addresses, which is the approach Microsoft Defender for Identity uses when 4662 events are unavailable.

How do I reduce false positives in DCSync detection?▼

Baseline all legitimate domain controllers and known replication service accounts, then alert only on SubjectUserName values that do not end with $ and are not on the allowlist. Explicitly exclude Azure AD Connect accounts like MSOL_* rather than filtering broadly.

Related Skills

Explore More Software Engineering Skills→
BreakerOfStemsBreakerOfStems

windows-remote

Administer Windows hosts via PowerShell commands over SSH reverse tunnels.

Community
Intermediate
AeonDaveAeonDave
15

mimikatz

Extract Windows credentials and Kerberos tickets from LSASS memory.

Community
Advanced
DorianGalloDorianGallo
5

active-directory-acl-abuse

Identifies and exploits misconfigured Active Directory ACLs to escalate privileges.

Community
Advanced
rjonhaasrjonhaas
1

EDR Telemetry & Live Hunt Collections

Analyze EDR exports and Velociraptor ZIPs to extract suspicious processes and persistence signals.

Community
Advanced