Unexpected Active Directory Replication Service Traffic

This analytic identifies unexpected Active Directory replication traffic originating from non-domain controller sources. It specifically looks for network traffic associated with AD replication protocols (ms-dc-replication, drsr, ad drs). Such traffic should typically only occur between legitimate domain controllers. Detection of this activity from other sources may indicate malicious activities like DCSync or DCShadow, which are commonly used for credential dumping and could lead to unauthorized access and potential domain-wide compromise.