DCSync Attack via Directory Replication Rights (Event ID 4662)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•4

Detects attempts to perform a DCSync attack by monitoring for Windows Event ID 4662 where sensitive Directory Replication Service (DRS) rights are requested. This attack pattern, often associated with tools like Mimikatz, allows an adversary to pull password data from Active Directory. The rule excludes requests from known domain controller accounts.