DCSync: Asking a Domain Controller to Hand Over Every Hash

DCSync abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR / DRSUAPI). An account holding the “Replicating Directory Changes” and “Replicating Directory Changes All” extended rights can call DRSGetNCChanges, impersonating a domain controller asking a real DC to replicate directory data. The DC returns credential material — NTLM hashes and Kerberos keys, including password history — for the requested accounts. Critically it runs remotely from a workstation, needs no code execution on the DC, and never touches LSASS or disk, so it evades many endpoint controls. MITRE ATT&CK tracks it as T1003.006.

How It Works

By default only Domain Admins, Enterprise Admins, Administrators and DC computer accounts hold the replication rights DCSync needs, so an attacker must already control an account granted them — not necessarily full Domain Admin. Once the hashes are pulled, the attacker can perform pass-the-hash or, by extracting the KRBTGT account’s keys, forge Golden Tickets (T1558.001) for domain-wide, long-lived persistence. T1003.006

Tooling

Mimikatz lsadump::dcsync, Impacket secretsdump.py (with -just-dc), and DSInternals implement the technique.

MITRE ATT&CK Mapping

Detection & Mitigation

• Alert on directory-replication requests (Event ID 4662 referencing the DS-Replication-Get-Changes control-access GUIDs) originating from source hosts that are not legitimate domain controllers.
• Audit and minimise which principals hold “Replicating Directory Changes (All)” rights; remove it from anything that is not a DC.
• Protect Tier-0 assets and tightly constrain privileged accounts that could hold replication rights.
• Where feasible, segment and restrict DRSUAPI RPC traffic so replication occurs only DC-to-DC.