Mimikatz DCSync DRSUAPI DsGetNCChanges RPC Over TCP 135/445

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•7

Detects anomalous network traffic patterns characteristic of the Mimikatz 'lsadump' module performing a DCSync attack. The rule monitors for DRSUAPI (Directory Replication Service Remote Protocol) RPC requests, specifically the DsGetNCChanges operation, which is abused to synchronize Active Directory data including sensitive password hashes.