DSInternals Get-ADReplAccount DCSync Attempt
This rule detects the execution of the `Get-ADReplAccount` cmdlet from the DSInternals PowerShell module with specific parameters (`-All` and `-Server`). This cmdlet is used to perform a DCSync attack, which allows an attacker to retrieve password hashes and other sensitive Active Directory information by simulating a domain controller replication. The DSInternals module provides advanced capabilities for Active Directory manipulation and auditing, and its use in this manner is highly suspicious and indicative of credential access attempts.
Sigma
