DCSync Directory Replication via DRSUAPI RPC

Lacey Cochrane@NullVectorX

•updated 4 days ago•1•0•3

Detects unauthorized or suspicious use of the DsGetNCChanges (opnum 3) function on the DRSUAPI interface. This RPC method is commonly abused in DCSync attacks to replicate domain controller data, including sensitive password hashes, from an Active Directory environment.