Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.
Start a fresh conversation. Replace the highlighted placeholders.
Use hunting-for-dcsync-attacks to conduct an authorized DCSync threat hunt using Event ID 4662 replication-right activity, distinguish non-domain-controller sources from approved replication partners, and produce the documented Hunt ID report with risk, evidence, and recommended actions for [SIEM platform, authorized domain scope, time window, and known DC/approved replication accounts].
Required inputs
[SIEM platform, authorized domain scope, time window, and known DC/approved replication accounts]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: hunting-for-dcsync-attacksdescription: Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.domain: cybersecuritysubdomain: threat-huntingtags: - threat-hunting- dcsync- active-directory- credential-access- t1003.006- mimikatz- windows- dfirversion: '1.0'author: mahipallicense: Apache-2.0d3fend_techniques: - Application Protocol Command Analysis- Network Isolation- Network Traffic Analysis- Client-server Payload Profiling- Platform Monitoringnist_csf: - DE.CM-01- DE.AE-02- DE.AE-07- ID.RA-05mitre_attack: - T1046- T1057- T1082- T1083- T1003
Hunting for DCSync Attacks
When to Use
When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)
After detecting Mimikatz or similar tools in the environment
During incident response involving Active Directory compromise
When monitoring for unauthorized domain replication requests
During purple team exercises testing AD attack detection
Prerequisites
Windows Security Event Log forwarding enabled (Event ID 4662)
Audit Directory Service Access enabled via Group Policy
Domain Computers SACL configured on Domain Object for machine account detection
SIEM with Windows event data ingested (Splunk, Elastic, Sentinel)
Knowledge of legitimate domain controller accounts and replication partners
Workflow
Enable Auditing: Ensure Audit Directory Service Access is enabled on domain controllers.
Collect Events: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access).
Filter Replication GUIDs: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
Identify Non-DC Sources: Flag events where SubjectUserName is not a domain controller machine account.
Correlate with Network: Cross-reference source IPs against known DC addresses.
Validate Findings: Exclude legitimate replication tools (Azure AD Connect, SCCM).