skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-dcsync-attacks

Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized replication requests.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#siem#credential dumping#Active Directory#DCSync#event 4662
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-dcsync-attacks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-dcsync-attacks
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-dcsync-attacks
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-dcsync-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

DCSync attacks let adversaries extract password hashes from Active Directory by abusing replication rights, and they are invisible without the right audit configuration and detection logic. This Skill provides a structured threat-hunting workflow to surface unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.

Core Features & Use Cases

  • Event 4662 Analysis: Filter Windows Security Event ID 4662 with AccessMask 0x100 for the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All GUIDs.
  • Non-DC Source Identification: Flag replication requests where the subject account is not a legitimate domain controller machine account, with guidance on whitelisting Azure AD Connect and backup tools.
  • Detection Gap Validation: Verify SACL and audit policy prerequisites, and validate the hunt fires using Mimikatz lsadump::dcsync or Impacket secretsdump.py.
  • Use Case: During incident response after a suspected AD compromise, run this hunt to identify whether an attacker performed DCSync from a non-DC host, then disable the account and reset krbtgt.

Quick Start

Hunt for DCSync activity in our environment by analyzing Windows Event ID 4662 for replication requests from non-domain-controller accounts.

Frequently Asked Questions about hunting-for-dcsync-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect DCSync attacks in Active Directory?▼

Detect DCSync by monitoring Windows Event ID 4662 with AccessMask 0x100 for the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All GUIDs. Flag events where the subject account is not a domain controller machine account and correlate source IPs against known DC addresses.

What Windows Event ID indicates a DCSync attack?▼

Event ID 4662 (Directory Service Access) indicates DCSync when it shows Control Access (AccessMask 0x100) on replication extended rights. The key GUIDs are 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 and 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2.

Why is Event 4662 not logging DCSync attempts?▼

Event 4662 is only generated if Audit Directory Service Access is enabled via Group Policy AND the domain object's SACL audits the replication extended rights. Without both configured, DCSync activity is completely invisible, so verify the SACL before trusting a clean result.

What causes false positives in DCSync detection?▼

Legitimate domain controller replication, Azure AD Connect (MSOL_ or AAD_ accounts), and some backup or migration tools trigger the same events. Whitelist by exact account and source IP together, never by name substring alone.

How do I validate that my DCSync detection rule works?▼

Run mimikatz lsadump::dcsync /user:krbtgt or Impacket secretsdump.py -just-dc from a non-DC host in a test environment. Confirm that Event 4662 with AccessMask 0x100 and the replication GUID appears and that your detection rule alerts.

Related Skills

Explore More Software Engineering Skills→
RedHatProductSecurityRedHatProductSecurity
47

logging

Implement structured JSON logging for data access and security events.

Official
Intermediate
ArianHobson333ArianHobson333
7

credential-access

Extract credentials via LSASS dumping, SAM/SECURITY hives, and DPAPI decryption.

Community
Advanced
htafollahtafolla
5

log-monitor

Analyze log streams, detect patterns, and trigger threshold-based alerts.

Community
Intermediate
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced