T1003.006_dcsync

T1003.006 DCSync

Sub-technique of: T1003

High-Level Description

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.

Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a Golden Ticket for use in Pass the Ticket or change an account's password as noted in Account Manipulation.

DCSync functionality has been included in the "lsadump" module in Mimikatz. Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.

Kill Chain Phase

• Credential Access (TA0006)

Platforms: Windows

What to Check

• Identify if DCSync technique is applicable to target environment
• Check Windows systems for indicators of DCSync
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: DCSync (Active Directory)

Active Directory attack allowing retrieval of account information without accessing memory or retrieving the NTDS database. Works against a remote Windows Domain Controller using the replication protocol. Privileges required: domain admin or domain controller account (by default), or any other account with required rights. Reference

Supported Platforms: windows

#{mimikatz_path} "lsadump::dcsync /domain:#{domain} /user:#{user}@#{domain}" "exit"

Dependencies:

• Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})

Atomic Test 2: Run DSInternals Get-ADReplAccount

The following Atomic will run Get-ADReplAccount from DSInternals. Upon successful execution, domain and credentials will appear in stdout. Reference CrowdStrike StellarParticle. https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/

Supported Platforms: windows

Get-ADReplAccount -All -Server #{logonserver}

Dependencies:

• DSInternals must be installed

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to DCSync by examining the target platforms (Windows).

2. Assess Existing Defenses: Review whether mitigations for T1003.006 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1027 Password Policies

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

M1015 Active Directory Configuration

Manage the access control list for "Replicating Directory Changes" and other permissions associated with domain controller replication.

M1026 Privileged Account Management

Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

Detection

Detection of Unauthorized DCSync Operations via Replication API Abuse

Risk Assessment

CWE Categories

References

• GitHub Mimikatz lsadump Module
• ADSecurity Mimikatz DCSync
• AdSecurity DCSync Sept 2015
• Microsoft DRSR Dec 2017
• Microsoft NRPC Dec 2017
• Microsoft GetNCCChanges
• Microsoft SAMR
• Samba DRSUAPI
• Harmj0y DCSync Sept 2015
• Harmj0y Mimikatz and DCSync
• InsiderThreat ChangeNTLM July 2017
• Wine API samlib.dll
• Atomic Red Team - T1003.006
• MITRE ATT&CK - T1003.006