Detect DCSync in Google Chronicle
Adversaries abuse the Windows Directory Replication Service (DRSUAPI) API to simulate replication from a domain controller and extract password data without direct access to the NTDS.dit file. Members of Administrators, Domain Admins, or Enterprise Admins groups can call IDL_DRSGetNCChanges to pull NTLM hashes and historical hashes for accounts including krbtgt. Mimikatz implements this as 'lsadump::dcsync'. Used by Mimikatz, Cobalt Strike, Earth Lusca, Mustang Panda, Storm-0501, and LAPSUS$. Enables Golden Ticket creation via krbtgt hash extraction.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1003 OS Credential Dumping
- Sub-technique
- T1003.006 DCSync
- Canonical reference
- https://attack.mitre.org/techniques/T1003/006/
YARA-L Detection Query
rule dcsync_drsuapi_replication_abuse {
meta:
author = "Detection Engineering"
description = "Detects DCSync attacks (T1003.006) by monitoring Windows Security Event 4662 for DRSUAPI DS-Replication-Get-Changes and DS-Replication-Get-Changes-All GUIDs on domain objects from non-machine accounts. Covers Mimikatz lsadump::dcsync, Cobalt Strike dcsync, and custom DRSUAPI tooling."
severity = "CRITICAL"
priority = "HIGH"
mitre_attack_tactic = "TA0006 - Credential Access"
mitre_attack_technique = "T1003.006 - OS Credential Dumping: DCSync"
false_positives = "Azure AD Connect, AD FS, identity sync tools with replication rights"
version = "1.0"
events:
$e.metadata.event_type = "USER_RESOURCE_ACCESS"
$e.metadata.product_name = "Microsoft-Windows-Security-Auditing"
$e.metadata.product_event_type = "4662"
(
$e.target.resource.attribute.labels["Object Type"] = "domainDNS"
or $e.target.resource.attribute.labels["Object Type"] = "domain"
)
(
$e.target.resource.attribute.labels["Properties"] = /1131f6aa-9c07-11d1-f79f-00c04fc2dcd2/ nocase
or $e.target.resource.attribute.labels["Properties"] = /1131f6ad-9c07-11d1-f79f-00c04fc2dcd2/ nocase
or $e.target.resource.attribute.labels["Access Mask"] = "0x100"
)
not $e.principal.user.userid = /\$$/ nocase
condition:
$e
}Google Chronicle YARA-L 2.0 rule that monitors UDM USER_RESOURCE_ACCESS events sourced from Microsoft-Windows-Security-Auditing for Event ID 4662 containing DRSUAPI replication right GUIDs. Targets domain and domainDNS object types, excludes machine accounts via principal.user.userid suffix matching, and fires on either DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, or 0x100 access mask.
Data Sources
Required Tables
False Positives & Tuning
- Azure Active Directory Connect and AAD Sync service accounts performing hybrid identity synchronization — these accounts have DS-Replication-Get-Changes rights and trigger Event 4662 on a regular schedule
- Active Directory Rights Management Services (AD RMS) or Certificate Services components that enumerate directory information using accounts with replication rights delegated during installation
- Enterprise SIEM or UEBA platforms (Splunk UBA, Microsoft Sentinel UEBA, Exabeam) that perform Active Directory enrichment using service accounts with read-access replication permissions
Other platforms for T1003.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1DCSync via Mimikatz lsadump::dcsync (krbtgt)
Expected signal: Security EventID 4662 on DC: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All access from the running user's account. Sysmon EventID 1 on workstation: process creation for mimikatz.exe with lsadump::dcsync in CommandLine. Network traffic on DRSUAPI RPC ports from workstation to DC.
- Test 2DCSync via Impacket secretsdump (Remote)
Expected signal: Security EventID 4662 on DC with DS-Replication-Get-Changes-All access from the provided account. Network connection from attacker IP to DC on port 445 and DRSUAPI RPC ports. SMB authentication events (EventID 4624) on DC from attacker IP.
- Test 3Check Account for Replication Rights (Reconnaissance)
Expected signal: PowerShell ScriptBlock Log EventID 4104 with Get-ADDomain and Get-Acl commands. Security EventID 4662 for domain object read access. Network connection to DC for LDAP query.
References (6)
- https://attack.mitre.org/techniques/T1003/006/
- https://adsecurity.org/?p=1729
- https://msdn.microsoft.com/library/cc228086.aspx
- https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump
- https://blog.harmj0y.net/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.006/T1003.006.md
Unlock Pro Content
Get the full detection package for T1003.006 including response playbook, investigation guide, and atomic red team tests.