Possible DCSync Attack

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•0•0

Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.