How do I install the Hunting For Dcsync Attacks skill?

Run npx skillmds@latest add gabrielmoreira/hunting-for-dcsync-attacks in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Hunting For Dcsync Attacks safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: executes scripts, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Hunting For Dcsync Attacks?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Hunting For Dcsync Attacks free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Hunting For Dcsync Attacks?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Hunting For Dcsync Attacks by gabrielmoreira

Name: Hunting For Dcsync Attacks
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

Hunting For Dcsync Attacks

Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.

gabrielmoreira Updated Sep 9, 2026 17 repo stars

File contents

Hunting for DCSync Attacks

When to Use

When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)
After detecting Mimikatz or similar tools in the environment
During incident response involving Active Directory compromise
When monitoring for unauthorized domain replication requests
During purple team exercises testing AD attack detection

Prerequisites

Windows Security Event Log forwarding enabled (Event ID 4662)
Audit Directory Service Access enabled via Group Policy
Domain Computers SACL configured on Domain Object for machine account detection
SIEM with Windows event data ingested (Splunk, Elastic, Sentinel)
Knowledge of legitimate domain controller accounts and replication partners

Workflow

Enable Auditing: Ensure Audit Directory Service Access is enabled on domain controllers.
Collect Events: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access).
Filter Replication GUIDs: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
Identify Non-DC Sources: Flag events where SubjectUserName is not a domain controller machine account.
Correlate with Network: Cross-reference source IPs against known DC addresses.
Validate Findings: Exclude legitimate replication tools (Azure AD Connect, SCCM).
Respond: Disable compromised accounts, reset krbtgt, investigate lateral movement.

Key Concepts

Concept	Description
DCSync	Technique abusing AD replication protocol to extract password hashes
Event ID 4662	Directory Service Access audit event
DS-Replication-Get-Changes	GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
DS-Replication-Get-Changes-All	GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
AccessMask 0x100	Control Access right indicating extended rights verification
T1003.006	OS Credential Dumping: DCSync

Tools & Systems

Tool	Purpose
Windows Event Viewer	Direct event log analysis
Splunk	SIEM correlation of Event 4662
Elastic Security	Detection rules for DCSync patterns
Mimikatz lsadump::dcsync	Attack tool used to perform DCSync
Impacket secretsdump.py	Python-based DCSync implementation
BloodHound	Identify accounts with replication rights

Output Format

Hunt ID: TH-DCSYNC-[DATE]-[SEQ]
Technique: T1003.006
Domain Controller: [DC hostname]
Subject Account: [Account performing replication]
Source IP: [Non-DC IP address]
GUID Accessed: [Replication GUID]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Disable account, reset krbtgt, investigate]

---name: hunting-for-dcsync-attacksdescription: Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.license: Apache-2.0--- # Hunting for DCSync Attacks ## When to Use - When hunting for DCSync credential theft (MITRE ATT&CK T1003.006) - After detecting Mimikatz or similar tools in the environment - During incident response involving Active Directory compromise - When monitoring for unauthorized domain replication requests - During purple team exercises testing AD attack detection ## Prerequisites - Windows Security Event Log forwarding enabled (Event ID 4662) - Audit Directory Service Access enabled via Group Policy - Domain Computers SACL configured on Domain Object for machine account detection - SIEM with Windows event data ingested (Splunk, Elastic, Sentinel) - Knowledge of legitimate domain controller accounts and replication partners ## Workflow 1. **Enable Auditing**: Ensure Audit Directory Service Access is enabled on domain controllers. 2. **Collect Events**: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access). 3. **Filter Replication GUIDs**: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. 4. **Identify Non-DC Sources**: Flag events where SubjectUserName is not a domain controller machine account. 5. **Correlate with Network**: Cross-reference source IPs against known DC addresses. 6. **Validate Findings**: Exclude legitimate replication tools (Azure AD Connect, SCCM). 7. **Respond**: Disable compromised accounts, reset krbtgt, investigate lateral movement. ## Key Concepts | Concept | Description | |---------|-------------| | DCSync | Technique abusing AD replication protocol to extract password hashes | | Event ID 4662 | Directory Service Access audit event | | DS-Replication-Get-Changes | GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 | | DS-Replication-Get-Changes-All | GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 | | AccessMask 0x100 | Control Access right indicating extended rights verification | | T1003.006 | OS Credential Dumping: DCSync | ## Tools & Systems | Tool | Purpose | |------|---------| | Windows Event Viewer | Direct event log analysis | | Splunk | SIEM correlation of Event 4662 | | Elastic Security | Detection rules for DCSync patterns | | Mimikatz lsadump::dcsync | Attack tool used to perform DCSync | | Impacket secretsdump.py | Python-based DCSync implementation | | BloodHound | Identify accounts with replication rights | ## Output Format ``` Hunt ID: TH-DCSYNC-[DATE]-[SEQ] Technique: T1003.006 Domain Controller: [DC hostname] Subject Account: [Account performing replication] Source IP: [Non-DC IP address] GUID Accessed: [Replication GUID] Risk Level: [Critical/High/Medium/Low] Recommended Action: [Disable account, reset krbtgt, investigate] ```

Frequently asked questions