Mimikatz DCSync DRSUAPI DsGetNCChanges RPC Over TCP 135/445

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•4

Detects anomalous network traffic patterns characteristic of the Mimikatz 'lsadump' module performing a DCSync attack. The rule monitors for DRSUAPI (Directory Replication Service Remote Protocol) RPC requests, specifically the DsGetNCChanges operation, which is abused to synchronize Active Directory data including sensitive password hashes.