T1003.006sub-technique of T1003 OS Credential Dumping
DCSync
Windows2 pieces on this siteT1003.006 on attack.mitre.org
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.
If this is happening now
Checklists and playbooks to open while the alert is still live.
First 15 minutes: an account was added to Domain Admins
A tier-zero group changed and nobody has a ticket for it. Whoever made the change is at least as compromised as the account they added. How to confirm, contain and scope without handing the operator another credential.
Domain-level access you cannot account for
An unexplained Domain Admin, directory replication by something that is not a domain controller, or a ticket that does not match any authentication.
how MITRE says to see it
Detection of Unauthorized DCSync Operations via Replication API Abuse
- Detects unauthorized invocation of replication operations (DCSync) via Directory Replication Service (DRS), often executed by threat actors using Mimikatz or similar tools from non-DC endpoints.
what reduces it
- M1027 Password Policies. Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
- M1015 Active Directory Configuration. Manage the access control list for "Replicating Directory Changes" and other permissions associated with domain controller replication.
- M1026 Privileged Account Management. Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.