DCSync
A directory-service replication request (Event ID 4662) invoking the DS-Replication-Get-Changes rights — a "DCSync" attack.
What it detects
A directory-service replication request (Event ID 4662) invoking the DS-Replication-Get-Changes rights — a "DCSync" attack. By asking a domain controller to replicate directory data, an attacker with the right privileges pulls password hashes (including krbtgt) for the ENTIRE domain without touching a DC's disk. When the requester is not itself a domain controller, this is a near-certain credential-theft attempt.
MITRE ATT&CK mapping
- T1003.006OS Credential Dumping: DCSync· Credential Access
False positives and triage
Domain controllers and some directory-sync services (e.g. Entra Connect) replicate legitimately. The signal is a replication request from an account or host that is NOT a domain controller / known sync service. Confirm the requester; a DCSync from a workstation or a user account is a domain-wide compromise.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/dcsync.yaml, licensed under the Apache License 2.0.
id: windows.credential.dcsync
version: 1.0.0
status: stable
severity: critical
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1003.006]
description: |
A directory-service replication request (Event ID 4662) invoking the
DS-Replication-Get-Changes rights — a "DCSync" attack. By asking a domain
controller to replicate directory data, an attacker with the right privileges
pulls password hashes (including krbtgt) for the ENTIRE domain without touching
a DC's disk. When the requester is not itself a domain controller, this is a
near-certain credential-theft attempt.
match:
native_event_id: 4662
raw_message_contains_any:
- "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
- "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
- "89e95b76-444d-4c62-991a-0facbeda640c"
correlation_keys: [user_name]
false_positive_guidance: |
Domain controllers and some directory-sync services (e.g. Entra Connect)
replicate legitimately. The signal is a replication request from an account or
host that is NOT a domain controller / known sync service. Confirm the requester;
a DCSync from a workstation or a user account is a domain-wide compromise.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.