How do you detect DCSync and Kerberoasting?

Detect DCSync by alerting on Windows Event ID 4662 containing the directory-replication control-access GUID (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) from any account that is not a legitimate domain controller. Detect Kerberoasting via Event ID 4769 requests using RC4 encryption (type 0x17), especially one account requesting many service principal names in a short window. Collect domain-controller security logs centrally, prefer AES-only and gMSA service accounts so RC4 requests stand out, and consider a honeypot SPN as a high-fidelity tripwire.

Detecting Active Directory Attacks: Kerberoasting, DCSync, NTLM Relay and AD CS

The Active Directory attack chain — Kerberoasting, DCSync, NTLM relay and AD CS abuse — is detectable from Windows security logs and domain-controller telemetry. This pack lists the high-fidelity signals and example Sigma/KQL logic for each. Collect domain-controller security logs centrally, and baseline normal behaviour before alerting.

Signals at a Glance

Attack	Primary signal	Technique
Kerberoasting	Event 4769 with RC4 (0x17) for SPN accounts; burst per account	T1558.003
DCSync	Event 4662 with replication GUIDs from a non-DC host	T1003.006
NTLM relay / coercion	Machine-account auth to the CA; NTLM from unexpected hosts; PetitPotam/PrinterBug RPC	T1187 T1557.001
AD CS abuse	Certificate issuance with mismatched subject/requester; cert logons for privileged accounts	T1649

DCSync

Alert on directory-replication requests that do not originate from a legitimate domain controller. The control-access right GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes) in Event 4662 is the key:

// Microsoft Sentinel / Defender (KQL)
SecurityEvent
| where EventID == 4662
| where Properties has "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
| where SubjectUserName !endswith "$"        // exclude DC machine accounts
| where SubjectUserName !in (KnownReplicationAccounts)
| project TimeGenerated, Computer, SubjectUserName, SubjectLogonId

Kerberoasting

Watch Event 4769 for RC4 (encryption type 0x17) ticket requests and for a single account requesting many distinct SPNs in a short window — a sign of bulk roasting. Prefer AES-only service accounts so RC4 requests stand out; a honeypot SPN that should never be requested is a high-fidelity tripwire.

NTLM Relay & AD CS

Alert on machine-account authentications to the AD CS web-enrolment endpoint and on certificate requests for machine accounts — hallmarks of the ESC8 relay path.
Monitor for coercion RPC (MS-RPRN PrinterBug, MS-EFSRPC PetitPotam) and for LLMNR/NBT-NS poisoning; detect NTLM authentication arriving at servers from hosts that should not initiate it.
Flag AD CS certificate issuance where the subject does not match the requester, and certificate-based logons for privileged accounts.

Tooling to hunt

Many of these map to named tools — Rubeus and Impacket GetUserSPNs (Kerberoasting), secretsdump (DCSync), ntlmrelayx and Certipy (relay/AD CS). The SigmaHQ repository ships community rules for each; validate against your DCs before enabling.

Harden and Monitor Active Directory

Mjolnir Security helps organisations build AD attack detections and close the paths behind them.

Detection EngineeringActive Directory SecurityManaged Detection & ResponseThreat HuntingIncident Response

Detection Engineering Deploying and tuning AD attack detections on your DCs.
Active Directory Security Review Finding and fixing the misconfigurations behind these attacks.
24/7 Incident Response Containment when domain compromise is suspected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 12, 2026