agentleFS
Sign inStart free
kaandgnshkaandgnsh/Claude-Blue/skills/active-directory-security/dcsync-detection/SKILL.md

dcsync-detection

Skill0 starsChanged 11 days agoMITView on GitHub

Detect DCSync and DCShadow — directory replication requested by non-DC principals — using event 4662 replication GUIDs, network DRSUAPI traffic and replication-rights audits. Use when credential dumping of the domain is suspected, when Mimikatz lsadump::dcsync is alerted, or when reviewing who holds replication rights.

The file

Create a free account to mount
Files
SKILL.md

DCSync / DCShadow Detection

Background

DCSync (T1003.006) uses the Directory Replication Service (DRSUAPI GetNCChanges) to pull password hashes, requiring the extended rights DS-Replication-Get-Changes 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 and DS-Replication-Get-Changes-All 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 (plus optionally 89e95b76-444d-4c62-991a-0facbeda640c In-Filtered-Set). Legitimate callers: domain controllers and (scoped) Entra Connect / MDI sensors.

Event-based detection

Enable Audit Directory Service Access on DCs and a SACL on the domain root for the replication rights. Then:

Sentinel:

SecurityEvent
| where EventID == 4662
| where Properties has_any ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2", "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2", "89e95b76-444d-4c62-991a-0facbeda640c")
| where SubjectUserName !endswith "$"
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName, Properties

Filter out the documented Entra Connect MSOL_/sync account only by exact name. Machine accounts ($) that are not DCs are also suspicious — compare against the DC list rather than filtering all $.

Network detection

DRSUAPI DRSGetNCChanges RPC from a source IP that isn't a DC (Zeek dce_rpc.log endpoint=drsuapi operation=DRSGetNCChanges; Microsoft Defender for Identity alert "Suspected DCSync attack").

DCShadow (T1207)

Rogue DC registration: creation of nTDSDSA objects / server objects under CN=Sites by non-DC hosts, SPNs GC/ or E3514235-4B06-11D1-AB04-00C04FC2DCD2/ added to a non-DC computer (5136 events), followed by replication from that host.

Audit replication rights

$dn = (Get-ADDomain).DistinguishedName
(Get-Acl "AD:$dn").Access | Where-Object { $_.ObjectType -in @('1131f6aa-9c07-11d1-f79f-00c04fc2dcd2','1131f6ad-9c07-11d1-f79f-00c04fc2dcd2') } |
  Select-Object IdentityReference, ActiveDirectoryRights, ObjectType

Anything other than Domain Controllers, Enterprise Domain Controllers, Administrators/Enterprise Admins (inherited) and the scoped sync account is a finding.

Response

Confirmed DCSync = all domain credentials compromised: plan full AD credential reset including krbtgt twice, service accounts, and trust keys (eradication-recovery).

Related skills

credential-theft-detection, kerberos-attack-detection, ad-attack-path-analysis, zeek-log-analysis

References

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free