T1003.006 DCSync
Sub-technique of T1003 OS Credential Dumping
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. Members…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Active Directory Replication from Non Machine Accountcriticaltest · windows
- Credential Dumping Tools Service Execution - Securityhightest · windows
- Credential Dumping Tools Service Execution - Systemhightest · windows
- HackTool - Mimikatz Executionhightest · windows
- Mimikatz DC Synchightest · windows
- Mimikatz Usehightest · windows
- Suspicious Get-ADReplAccountmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.