Active Directory Replication from Non Machine Account - DcSync Indicator

 1title: Active Directory Replication from Non Machine Account - DcSync Indicator
 2id: 17d619c1-e020-4347-957e-1d1207455c93
 3related:
 4    - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a # Suspicious Machine Account Replication - DcSync Indicator
 5      type: similar
 6status: test
 7description: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
 8references:
 9    - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
10    - https://threathunterplaybook.com/library/windows/active_directory_replication.html
11    - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
12author: Roberto Rodriguez @Cyb3rWard0g
13date: 2019-07-26
14modified: 2026-07-30
15tags:
16    - attack.credential-access
17    - attack.t1003.006
18logsource:
19    product: windows
20    service: security
21    definition: |
22        Requirements: A SACL must be configured on the domain NC root object (e.g. DC=domain,DC=com)
23        to generate Event 4662. Add via ADSI Edit: navigate to the domain NC root → Properties →
24        Security → Advanced → Auditing → add an ACE for Everyone, Type: Success, Applies to:
25        This object only, rights: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
26        The OS audit subcategory must also be enabled:
27        auditpol /set /subcategory:"Directory Service Access" /success:enable        
28detection:
29    selection:
30        EventID: 4662
31        Properties|contains:
32            - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes-All
33            - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes
34            - '9923a32a-3607-11d2-b9be-0000f87a36b2' # DS-Replication-Synchronize
35            - '89e95b76-444d-4c62-991a-0facbeda640c' # DS-Replication-Get-Changes-In-Filtered-Set
36    filter_main_machine_accounts:
37        SubjectUserName|endswith: '$'
38    filter_optional_subject_domain:
39        SubjectDomainName: 'Window Manager'
40    filter_optional_subject_usersid:
41        SubjectUserName|startswith:
42            - 'NT AUT'
43            - 'MSOL_' # https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-accounts-permissions#ad-ds-connector-account
44    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
45falsepositives:
46    - Unknown
47level: medium