Replication privileges granted to perform DCSync attack

title: Replication privileges granted to perform DCSync attack
description: Detects scenarios where an attacker grants replication privilege to an account to exflitrate Active Directory credentials
requirements: auditing SACL "Modify permissions" must be placed on the root domain container (otherwise not visible) using the Active Directory console (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html).
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
- https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync
- https://blog.fox-it.com/2018/04/26/escalating-privileges-with-acls-in-active-directory/
- https://simondotsh.com/infosec/2022/07/11/dirsync.html
- https://www.logpoint.com/en/blog/compromises-in-azure-ad-through-aad-connect/
tags:
  - attack.credential_access
  - attack.t1222.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: ntSecurityDescriptor
    OperationType: '%%14674'  # value added  
    AttributeValue|contains:
      - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 # DS-Replication-Get-Changes
      - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 # DS-Replication-Get-Changes-All
      - 89e95b76-444d-4c62-991a-0facbeda640c # DS-Replication-Get-Changes-In-Filtered-Set
  filter:
    SubjectUserName|endswith: $
  condition: selection and not filter
falsepositives:
- Unknown
level: high