DCSync Attack: Detecting AD Hash Theft — Akuity SOC

Within the threat actor toolkit targeting Active Directory, the DCSync technique (MITRE ATT&CK T1003.006) represents one of the most critical threats. Leveraged by tools like Mimikatz and Impacket's secretsdump.py, it allows adversaries to dump all domain credentials without ever executing binary code on a Domain Controller (DC) or extracting the raw NTDS.dit database file. Detecting this technique swiftly is a top priority for CISOs and SecOps teams.

Technical Anatomy: Exploiting the MS-DRSR Protocol

DCSync does not rely on a software exploit. Instead, it abuses standard administrative replication features exposed by the MS-DRSR (Directory Replication Service Remote Protocol). An attacker with compromised credentials possessing elevated replication rights invokes the drsuapi RPC interface.

By calling the IDL_DRSGetNCChanges API, the attacking workstation impersonates a genuine Domain Controller requesting directory updates. The threat actor specifically pulls sensitive credential attributes, including NTLM hashes and Kerberos keys—most critically the krbtgt account hash, opening the door to immediate Golden Ticket creation.

The Traditional SIEM Blind Spot

Attempting to catch DCSync via standard Windows Security Logs (specifically Event ID 4662: Operation on an object) creates extreme alert fatigue. Domain Controllers replicate continuously. The real challenge lies in correlating the requesting user identity, the source IP address, and the specific extended right GUIDs requested:

• DS-Replication-Get-Changes (GUID: 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2)
• DS-Replication-Get-Changes-All (GUID: 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2)
• DS-Replication-Get-Changes-In-Filtered-Set (GUID: 89e95b76-444d-4c62-991a-0facbeda0a23)

Traditional log-centric SIEMs lack network RPC protocol visibility and fail to distinguish benign DC-to-DC replication from unauthorized RPC requests initiated from an arbitrary domain workstation.

Advanced Threat Hunting: KQL for Defender for Identity

By leveraging Defender for Identity network sensors, domain-level RPC queries are evaluated before log overhead can obscure them. The following Advanced Hunting (KQL) query surfaces unauthorized replication requests originating from non-DC accounts:

IdentityDirectoryEvents
| where ActionType in ("Directory Services replication", "Replication requested")
| extend ParsedFields = parse_json(AdditionalFields)
| extend NamingContext = tostring(ParsedFields.NamingContext),
         AttributesRequested = tostring(ParsedFields.AttributesRequested)
| where AttributesRequested has_any (
    "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2", // DS-Replication-Get-Changes
    "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2", // DS-Replication-Get-Changes-All
    "89e95b76-444d-4c62-991a-0facbeda0a23"  // DS-Replication-Get-Changes-In-Filtered-Set
)
| where not(AccountName endswith "$" and DestinationDeviceName has AccountName)
| where not(AccountName startswith "MSOL_" or AccountName startswith "Sync_")
| project Timestamp, ActionType, AccountName, AccountDomain, IPAddress,
          DestinationDeviceName, NamingContext, ReportId
| sort by Timestamp desc

Automated SOAR Orchestration with Akuity SOC

Surfacing a DCSync attempt demands an incident response SLA of under 5 minutes to prevent Golden Ticket forging and persistent administrative access:

1. Instant Qualification: Akuity SOC's in-app AI assistant inspects RPC queries and validates replication GUID legitimacy in under 2 seconds, with zero telemetry leakage to third-party public decoders.
2. 1-Click SOAR Containment: Execute instant host containment via isolateDevice() in Defender for Endpoint and complete identity revocation through confirmUserCompromised() and revokeSessions() in Microsoft Entra ID directly from the evidence ledger.
3. Zero-Trust Governance: All remediation operations enforce mandatory step-up authentication via MFA AAL2, immutably recorded for NIS 2 and SOC 2 Type II audit compliance.

Technical Mini-FAQ

Which accounts possess DCSync privileges by default?

By default, only members of Domain Admins, Enterprise Admins, Administrators, and Domain Controller machine accounts are granted replication rights. However, misconfigured delegation or overprivileged service accounts (such as poorly audited backup solutions) often expose these permissions to unauthorized actors.

How does Microsoft Entra Connect avoid triggering false positives?

The synchronization account used by Microsoft Entra Connect (often named MSOL_xxxx or Sync_xxxx) holds legitimate directory replication rights. Precise threat hunting rules explicitly exclude these pre-approved service accounts and legitimate domain controller machine accounts.