Rogue Domain Controller Replication Request
This rule detects a replication request to a Domain Controller (DC) containing the string "DsGetNCChanges" over TCP port 389 (LDAP). This specific string is associated with Active Directory replication. The rule is designed to identify potential rogue Domain Controllers attempting to replicate with legitimate DCs, which could indicate an attacker trying to establish a malicious DC for credential harvesting or other attacks. A threshold of 3 occurrences within 60 seconds from the same source IP is set to reduce false positives.
Suricata
