DCSync: credential dumping via AD replication

DCSync is a credential dumping technique that abuses Active Directory replication to extract password hashes without executing code on a Domain Controller. The attack impersonates a Domain Controller by invoking the DRSUAPI remote protocol, specifically the IDL_DRSGetNCChanges function. Any principal granted the DS-Replication-Get-Changes-All extended right can request replication data, including NTLM hashes and Kerberos keys for any account, including krbtgt. This makes DCSync particularly dangerous: an attacker with sufficient privileges can silently pull the krbtgt hash and forge Golden Tickets, achieving persistent, domain-wide access. No code runs on the DC itself, and no LSASS memory is touched, which bypasses many traditional credential-dumping detection controls. The technique was popularized by Mimikatz through its lsadump::dcsync module. Because it relies on a legitimate AD protocol, traffic is difficult to distinguish from genuine replication at a network level without dedicated tooling.

Detecting DCSync requires monitoring both network traffic and Active Directory audit logs. On the DC, enable auditing of Directory Service Access (Event ID 4662) and filter for operations on the domainDNC object where the GUID matches DS-Replication-Get-Changes-All ({1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}) or DS-Replication-Get-Changes ({1131f6ab-9c07-11d1-f79f-00c04fc2dcd2}). Legitimate replication events originate from machine accounts of known DCs. Any user account or non-DC machine account triggering Event ID 4662 with these GUIDs is a high-fidelity indicator of DCSync. At the network layer, look for DRSUAPI RPC calls (UUID e3514235-4b06-11d1-ab04-00c04fc2dcd2) originating from a host that is not a registered DC. SIEM rules in Splunk, Microsoft Sentinel, or Elastic SIEM can correlate source IP against the known DC list. Tools like Zeek with the dcerpc analyzer or commercial NDR platforms can flag anomalous DRSUAPI sessions. Alert on any replication request outside scheduled replication windows.

Red Team operators use DCSync via Mimikatz with the command lsadump::dcsync /domain:target.local /user:krbtgt to retrieve the krbtgt NTLM hash and AES keys. The same technique extracts hashes for any privileged account, enabling Pass-the-Hash or Overpass-the-Hash attacks. CrackMapExec and Impacket's secretsdump.py also implement DCSync natively, making it accessible without Mimikatz on disk. The prerequisite is control of an account holding DS-Replication-Get-Changes-All, typically a Domain Admin, Account Operators member, or any account explicitly delegated this right. Defenders should audit ACLs on the domain root object regularly, using tools like BloodHound or PowerView's Get-ObjectAcl to identify non-standard replication delegations. Revoke unnecessary replication rights immediately. Tiered administration models limit the blast radius by ensuring privileged accounts are never exposed on workstations. Rotating the krbtgt password twice invalidates existing Golden Tickets. Microsoft's Credential Guard does not block DCSync since it targets LSASS, not DRSUAPI-based extraction.