DCSync abuses the directory replication protocol to pull password hashes, including krbtgt, without touching a DC’s disk or LSASS. The request is legitimate protocol traffic, so the signal is who asks: an account or an IP address that is not a Domain Controller. That is a precise, low-noise detection once Directory Service Access auditing is on.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| 4662 with replication GUIDs from a non-DC account | DC Security 4662 | T1003.006 |
| DRSGetNCChanges RPC from a host that is not a DC | Zeek dce_rpc, network | T1003.006 |
| Replication rights granted to a user or group on the domain object | DC Security 5136 | T1222 |
| Logon of a replication-capable account from an unusual host | DC Security 4624 | T1078.002 |
Event 4662 and the Replication GUIDs
When the Audit Directory Service Access subcategory is enabled and the domain object carries a SACL, a replication request generates Event ID 4662 with the control-access right in the Properties field. Three GUIDs matter: 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes), 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 (Get-Changes-All) and 89e95b76-444d-4c62-991a-0facbeda640c (Get-Changes-In-Filtered-Set). Get-Changes-All is the one that returns secrets:
let dcs = dynamic(["DC01$","DC02$"]); // tune/validate: all DC machine accounts
SecurityEvent
| where EventID == 4662
| where Properties has "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
or Properties has "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
or Properties has "89e95b76-444d-4c62-991a-0facbeda640c"
| where AccessMask == "0x100"
| where SubjectUserName !in (dcs) and SubjectUserName !endswith "$"
| where SubjectUserName !startswith "MSOL_" // Entra Connect sync, confirm in your tenant
| project TimeGenerated, Computer, SubjectUserName, SubjectLogonId, ObjectName
Do not exclude every account ending in a dollar sign without checking: an attacker who controls a computer account with replication rights can DCSync from it. Prefer an explicit list of Domain Controller accounts.
Network View and Permission Grants
The network view does not depend on SACLs. DRSUAPI is an RPC interface, and a DRSGetNCChanges call from an IP that is not in your Domain Controller list is the same event seen from the wire:
index=zeek sourcetype="bro:dce_rpc:json" endpoint=drsuapi
(operation=DRSGetNCChanges OR operation=DRSBind)
| search NOT [| inputlookup domain_controller_ips.csv | fields id.orig_h]
| stats count min(_time) AS first max(_time) AS last by id.orig_h, id.resp_h, operation
# tune/validate: domain_controller_ips.csv is your own inventory; also exclude
# documented replication tooling such as migration or sync appliances.
- Alert on 5136 changes to the domain root
nTSecurityDescriptorthat add replication rights to any non-default principal. - Audit who holds replication rights today: Domain Controllers, Enterprise Domain Controllers and any sync service account, and nothing else.
- After an alert, treat all passwords in the domain, and krbtgt twice, as exposed.
Use the SigmaHQ and Elastic DCSync rules, the Splunk ESCU directory-replication analytics and Microsoft’s AD audit-policy recommendations. Baseline your own environment — identity-sync and migration tools legitimately replicate, and each must be named in an exception list rather than excluded by pattern.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts