Potential DC Sync attack detected

Threat Scout@ThreatScout

•updated Oct 7, 2025•37•8•793

Detects potential DC Sync attacks, where an adversary mimics a domain controller to request credential data using replication permissions. This rule identifies Event ID 4662 with AccessMask 0x100 and specific replication-related properties, excluding known benign accounts.