Replication privileges accessed to perform DCSync attack

title: Replication privileges accessed to perform DCSync attack
description: Detects scenarios where an attacker use DCSync or SecretDump tool to exfiltrate Active Directory credentials
requirements: extended rights auditing enabled (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
- https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync
- https://blog.fox-it.com/2018/04/26/escalating-privileges-with-acls-in-active-directory/
- https://simondotsh.com/infosec/2022/07/11/dirsync.html
- https://www.logpoint.com/en/blog/compromises-in-azure-ad-through-aad-connect/
- https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/
tags:
  - attack.credential_access
  - attack.t1003.006
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    AccessMask: 0x100
    Properties|contains:
      - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 # DS-Replication-Get-Changes
      - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 # DS-Replication-Get-Changes-All
      - 89e95b76-444d-4c62-991a-0facbeda640c # DS-Replication-Get-Changes-In-Filtered-Set
  filter:
    SubjectUserName|endswith: $
  condition: selection and not filter
falsepositives:
- SharePoint accounts (FIM usage)
level: high