DCSync — Post-Remediation Credential Re-Harvest
This hunt targets a documented Iranian MOIS-affiliated behaviour: re-executing DCSync (MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset compromised account passwords, allowing actors to recollect current and historical NTLM hashes and restore domain-wide access without repeating initial access stages.
Microsoft Sentinel (KQL)
