Applied Cybernetics Group
T1003.006 DCSync
- Technique
T1003.006- Tactics
- Credential Access
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 7
- Elastic, Splunk
- 7
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1003/006
MITRE description
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017)(Citation: Microsoft GetNCCChanges)(Citation: Samba DRSUAPI)(Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-21Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Detection coverage
SigmaHQ community rules
- Active Directory Replication from Non Machine Account (core)
- Mimikatz DC Sync (core)
- Credential Dumping Tools Service Execution - Security (core)
- Credential Dumping Tools Service Execution - System (core)
- Mimikatz Use (core)
- Suspicious Get-ADReplAccount (core)
- HackTool - Mimikatz Execution (core)
Elastic and Splunk rules
- First Time Seen Account Performing DCSync (elastic)
- Potential Credential Access via DCSync (elastic)
- Potential Active Directory Replication Account Backdoor (elastic)
- Potential Invoke-Mimikatz PowerShell Script (elastic)
- Potential PowerShell HackTool Script by Function Names (elastic)
- Windows AD Replication Request Initiated by User Account (splunk)
- Windows AD Replication Request Initiated from Unsanctioned Location (splunk)