Suspicious Machine Account Replication - DcSync Indicator

calendar Aug 5, 2026 · attack.credential-access attack.s0002 attack.t1003.006 cve.2026-54121  ·
Share on: linkedin copy

Detects suspicious Active Directory Replication Service (ADRS) requests originating from a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.

Under normal operation, only Domain Controllers initiate replication requests carrying the DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account credentials — for example by abusing certificate-based authentication (PKINIT) to impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost), where a temporary machine account is created to request a DC certificate and then used to perform DCSync — they can dump all domain credential material including the krbtgt hash.

Sigma rule (View on GitHub)

 1title: Suspicious Machine Account Replication - DcSync Indicator
 2id: 611eab06-a145-4dfa-a295-3ccc5c20f59a
 3related:
 4    - id: 17d619c1-e020-4347-957e-1d1207455c93 # Active Directory Replication from Non Machine Account
 5      type: similar
 6status: test
 7description: |
 8    Detects suspicious Active Directory Replication Service (ADRS) requests originating from
 9    a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.
10
11    Under normal operation, only Domain Controllers initiate replication requests carrying the
12    DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
13    credentials — for example by abusing certificate-based authentication (PKINIT) to
14    impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
15    where a temporary machine account is created to request a DC certificate and then used to
16    perform DCSync — they can dump all domain credential material including the krbtgt hash.    
17references:
18    - https://twitter.com/gentilkiwi/status/1003236624925413376
19    - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
20    - https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r
21    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
22    - https://github.com/aniqfakhrul/CVE-2026-54121
23author: Benjamin Delpy, Florian Roth (Nextron Systems), Scott Dermett, Sorina Ionescu
24date: 2018-06-03
25modified: 2026-07-30
26tags:
27    - attack.credential-access
28    - attack.s0002
29    - attack.t1003.006
30    - cve.2026-54121
31logsource:
32    product: windows
33    service: security
34    definition: |
35        Requirements: A SACL must be configured on the domain NC root object (e.g. DC=domain,DC=com)
36        to generate Event 4662. Add via ADSI Edit: navigate to the domain NC root → Properties →
37        Security → Advanced → Auditing → add an ACE for Everyone, Type: Success, Applies to:
38        This object only, rights: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
39        The OS audit subcategory must also be enabled:
40        auditpol /set /subcategory:"Directory Service Access" /success:enable        
41detection:
42    selection:
43        EventID: 4662
44        Properties|contains:
45            - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes-All
46            - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes
47            - '9923a32a-3607-11d2-b9be-0000f87a36b2' # DS-Replication-Synchronize
48            - '89e95b76-444d-4c62-991a-0facbeda640c' # DS-Replication-Get-Changes-In-Filtered-Set
49        SubjectUserName|endswith: '$'
50    filter_main_subject_usersid:
51        SubjectUserSid|startswith: 'S-1-5-18'
52    condition: selection and not 1 of filter_main_*
53falsepositives:
54    - Valid DC Sync that is not covered by the filters; please report
55level: medium

References

Related rules

to-top