Hunting for DCSync Attacks
FreeDetect DCSync attacks in Active Directory environments.
Free · Opens the source repo
What Hunting for DCSync Attacks does
The Hunting for DCSync Attacks skill is designed to help security professionals identify and respond to DCSync credential theft attempts within Active Directory environments. By analyzing Windows Event ID 4662, the skill focuses specifically on requests made by non-domain-controller accounts that could indicate malicious activity. This is particularly relevant for organizations that have experienced Mimikatz or similar tooling in their environment, as these tools are often used to exploit Active Directory replication protocols for credential theft.
To effectively use this skill, users must ensure that Windows Security Event Log forwarding is enabled and that auditing for Directory Service Access is configured correctly. The skill guides users through a workflow that includes collecting relevant event logs, filtering for specific replication GUIDs, and identifying unauthorized access attempts. By correlating these findings with network data, security teams can better understand the scope of the attack and take appropriate actions, such as disabling compromised accounts or resetting critical security credentials.
This skill is particularly beneficial during incident response scenarios, purple team exercises, or any situation where monitoring for unauthorized domain replication requests is crucial. It provides a structured approach to threat hunting, allowing security analysts to validate findings and respond effectively to potential breaches. With the rise in credential theft techniques targeting Active Directory, having a tool that specifically addresses DCSync attacks is invaluable for maintaining a secure environment.
When to use it
Use this skill when you suspect DCSync credential theft or have detected Mimikatz-like activities in your network.
When not to use it
This skill is not suitable for environments that lack Windows Event Log forwarding or where Active Directory auditing is not enabled.
What you can build with it
Incident Response to Credential Theft
Utilize the skill to identify and respond to DCSync attacks during an ongoing incident involving credential theft.
Purple Team Exercises
Employ this skill in purple team exercises to evaluate the effectiveness of detection mechanisms against DCSync techniques.
Monitoring Unauthorized Replication Requests
Use the skill to continuously monitor for unauthorized domain replication requests in your Active Directory environment.
How to install Hunting for DCSync Attacks
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-dcsync-attacks --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting for DCSync Attacks
When to Use
- When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)
- After detecting Mimikatz or similar tools in the environment
- During incident response involving Active Directory compromise
- When monitoring for unauthorized domain replication requests
- During purple team exercises testing AD attack detection
Prerequisites
- Windows Security Event Log forwarding enabled (Event ID 4662)
- Audit Directory Service Access enabled via Group Policy
- Domain Computers SACL configured on Domain Object for machine account detection
- SIEM with Windows event data ingested (Splunk, Elastic, Sentinel)
- Knowledge of legitimate domain controller accounts and replication partners
Workflow
- Enable Auditing: Ensure Audit Directory Service Access is enabled on domain controllers.
- Collect Events: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access).
- Filter Replication GUIDs: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
- Identify Non-DC Sources: Flag events where SubjectUserName is not a domain controller machine account.
- Correlate with Network: Cross-reference source IPs against known DC addresses.
- Validate Findings: Exclude legitimate replication tools (Azure AD Connect, SCCM).
- Respond: Disable compromised accounts, reset krbtgt, investigate lateral movement.
Key Concepts
| Concept | Description |
|---|---|
| DCSync | Technique abusing AD replication protocol to extract password hashes |
| Event ID 4662 | Directory Service Access audit event |
| DS-Replication-Get-Changes | GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 |
| DS-Replication-Get-Changes-All | GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 |
| AccessMask 0x100 | Control Access right indicating extended rights verification |
| T1003.006 | OS Credential Dumping: DCSync |
Tools & Systems
| Tool | Purpose |
|---|---|
| Windows Event Viewer | Direct event log analysis |
| Splunk | SIEM correlation of Event 4662 |
| Elastic Security | Detection rules for DCSync patterns |
| Mimikatz lsadump::dcsync | Attack tool used to perform DCSync |
| Impacket secretsdump.py | Python-based DCSync implementation |
| BloodHound | Identify accounts with replication rights |
Output Format
Hunt ID: TH-DCSYNC-[DATE]-[SEQ]
Technique: T1003.006
Domain Controller: [DC hostname]
Subject Account: [Account performing replication]
Source IP: [Non-DC IP address]
GUID Accessed: [Replication GUID]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Disable account, reset krbtgt, investigate]
Frequently asked questions about Hunting for DCSync Attacks
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.