Individual skill

detecting-dcsync-attack-in-active-directory

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.

internal/tools/skills/data/threat-hunting/detecting-dcsync-attack-in-active-directory/SKILL.md

Read pinned source

Source commit d42f381ad34843e71a42658e5c57290c713e85af

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 7, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 1,310
Repository last updated: Nov 7, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

cybersecurity Repository topic
security Repository topic
bug-bounty Repository topic
automation Repository topic
autonomous-pentesting Repository topic
ai-agent Repository topic
ai-security Repository topic
ethical-hacking Repository topic
golang Repository topic
penetration-testing Repository topic
threat-hunting Declared skill tag
active-directory Declared skill tag
dcsync Declared skill tag
credential-theft Declared skill tag
mitre-t1003-006 Declared skill tag
mimikatz Declared skill tag
kerberos Declared skill tag
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 7,964 bytes

Read excerpt


# Detecting DCSync Attack in Active Directory

## When to Use

- When hunting for credential theft in Active Directory environments
- After compromise of accounts with Replicating Directory Changes permissions
- When investigating suspected use of Mimikatz or Impacket secretsdump
- During incident response involving lateral movement with domain admin credentials
- When auditing AD replication permissions as part of security hardening

## Detection Gaps & Validation

- **No SACL = no 4662.** The detection depends entirely on an audit SACL on the domain object covering "Replicating Directory Changes." Without it the DCSync generates zero 4662 events. Verify the SACL on the domain root and that `auditpol /get /subcategory:"Directory Service Access"` shows Success.
- **Properties field gets dropped.** Many log pipelines truncate or omit the 4662 `Properties` field that carries the replication GUIDs (`1131f6aa-…`, `1131f6ad-…`). Confirm your parser preserves it or the query matches nothing.