DCSync Directory Replication Request (DRSUAPI GetNCChanges)

Ibrahim Saud@tektrix

•updated 6 days ago•0•0•0

Detects the invocation of Active Directory replication rights by monitoring Event 4662 for specific directory service replication GUIDs (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All). This behavior is characteristic of adversary techniques such as DCSync used by tools like Mimikatz lsadump::dcsync or Impacket secretsdump to extract domain password hashes.