＋ Add to collection

Install (CLI)

npx skillmds add mukul975/hunting-for-dcsync-attacks

Or Copy and Paste in Your Agent chat

Please install the Agent Skill "mukul975/hunting-for-dcsync-attacks" for me from skillmd.com. A SkillMD skill is a SKILL.md file — plain markdown plus a few companion files — that you save into my skills directory. Use whichever fetch route fits your setup: (1) if you have a terminal, run npx -y skillmds add mukul975/hunting-for-dcsync-attacks; (2) otherwise fetch the file manifest at https://api.skillmd.com/api/skills/mukul975/hunting-for-dcsync-attacks/bundle?format=manifest and download each listed file from its "url" into hunting-for-dcsync-attacks/ in your skills directory; (3) if the SkillMD MCP tools are connected, call skillmd_download with slug "mukul975/hunting-for-dcsync-attacks" and save the returned files under hunting-for-dcsync-attacks/. Show me the SKILL.md before saving if you'd like me to review it. If your skills directory is read-only (e.g. the Claude desktop app), save the files to a working folder instead and tell me — I'll add them through my app's skills settings.

README badge

Show this skill's registry status in your repo:

[![SkillMD](https://skillmd.com/badge/mukul975/hunting-for-dcsync-attacks.svg)](https://skillmd.com/skills/mukul975/hunting-for-dcsync-attacks)

hunting-for-dcsync-attacks

Name: hunting-for-dcsync-attacks
Rating: 4.2 (5 reviews)
Author: mukul975

mukul975/hunting-for-dcsync-attacks · Agent Skill (multi-file)

by mukul975 · bundle

Published Jul 5, 2026 · Last updated Jul 6, 2026

Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.

SKILL.md

Hunting for DCSync Attacks

When to Use

When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)
After detecting Mimikatz or similar tools in the environment
During incident response involving Active Directory compromise
When monitoring for unauthorized domain replication requests
During purple team exercises testing AD attack detection

Prerequisites

Windows Security Event Log forwarding enabled (Event ID 4662)
Audit Directory Service Access enabled via Group Policy
Domain Computers SACL configured on Domain Object for machine account detection
SIEM with Windows event data ingested (Splunk, Elastic, Sentinel)
Knowledge of legitimate domain controller accounts and replication partners

Workflow

Enable Auditing: Ensure Audit Directory Service Access is enabled on domain controllers.
Collect Events: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access).
Filter Replication GUIDs: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
Identify Non-DC Sources: Flag events where SubjectUserName is not a domain controller machine account.
Correlate with Network: Cross-reference source IPs against known DC addresses.
Validate Findings: Exclude legitimate replication tools (Azure AD Connect, SCCM).
Respond: Disable compromised accounts, reset krbtgt, investigate lateral movement.

Key Concepts

Concept	Description
DCSync	Technique abusing AD replication protocol to extract password hashes
Event ID 4662	Directory Service Access audit event
DS-Replication-Get-Changes	GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
DS-Replication-Get-Changes-All	GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
AccessMask 0x100	Control Access right indicating extended rights verification
T1003.006	OS Credential Dumping: DCSync

Tools & Systems

Tool	Purpose
Windows Event Viewer	Direct event log analysis
Splunk	SIEM correlation of Event 4662
Elastic Security	Detection rules for DCSync patterns
Mimikatz lsadump::dcsync	Attack tool used to perform DCSync
Impacket secretsdump.py	Python-based DCSync implementation
BloodHound	Identify accounts with replication rights

Output Format

Hunt ID: TH-DCSYNC-[DATE]-[SEQ]
Technique: T1003.006
Domain Controller: [DC hostname]
Subject Account: [Account performing replication]
Source IP: [Non-DC IP address]
GUID Accessed: [Replication GUID]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Disable account, reset krbtgt, investigate]

---
name: hunting-for-dcsync-attacks
description: Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.
license: Apache-2.0
---

# Hunting for DCSync Attacks

## When to Use

- When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)
- After detecting Mimikatz or similar tools in the environment
- During incident response involving Active Directory compromise
- When monitoring for unauthorized domain replication requests
- During purple team exercises testing AD attack detection

## Prerequisites

- Windows Security Event Log forwarding enabled (Event ID 4662)
- Audit Directory Service Access enabled via Group Policy
- Domain Computers SACL configured on Domain Object for machine account detection
- SIEM with Windows event data ingested (Splunk, Elastic, Sentinel)
- Knowledge of legitimate domain controller accounts and replication partners

## Workflow

1. **Enable Auditing**: Ensure Audit Directory Service Access is enabled on domain controllers.
2. **Collect Events**: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access).
3. **Filter Replication GUIDs**: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
4. **Identify Non-DC Sources**: Flag events where SubjectUserName is not a domain controller machine account.
5. **Correlate with Network**: Cross-reference source IPs against known DC addresses.
6. **Validate Findings**: Exclude legitimate replication tools (Azure AD Connect, SCCM).
7. **Respond**: Disable compromised accounts, reset krbtgt, investigate lateral movement.

## Key Concepts

| Concept | Description |
|---------|-------------|
| DCSync | Technique abusing AD replication protocol to extract password hashes |
| Event ID 4662 | Directory Service Access audit event |
| DS-Replication-Get-Changes | GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 |
| DS-Replication-Get-Changes-All | GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 |
| AccessMask 0x100 | Control Access right indicating extended rights verification |
| T1003.006 | OS Credential Dumping: DCSync |

## Tools & Systems

| Tool | Purpose |
|------|---------|
| Windows Event Viewer | Direct event log analysis |
| Splunk | SIEM correlation of Event 4662 |
| Elastic Security | Detection rules for DCSync patterns |
| Mimikatz lsadump::dcsync | Attack tool used to perform DCSync |
| Impacket secretsdump.py | Python-based DCSync implementation |
| BloodHound | Identify accounts with replication rights |

## Output Format

```
Hunt ID: TH-DCSYNC-[DATE]-[SEQ]
Technique: T1003.006
Domain Controller: [DC hostname]
Subject Account: [Account performing replication]
Source IP: [Non-DC IP address]
GUID Accessed: [Replication GUID]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Disable account, reset krbtgt, investigate]
```

Files

This skill is a package of 4 files. Install with the command above, or download the folder.

📄SKILL.md entry
📁references
📄api-reference.md 3.4 KB
📁scripts
⚙️agent.py 9.7 KB
📄LICENSE 11.0 KB

mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/hunting-for-dcsync-attacks commit · 673da1f3b0

▌
detecting-dcsync-attack-in-active-directory · mukul975 bundle
Detect DCSync attacks by monitoring Active Directory replication requests from non-domain-controller accounts via Event ID 4662 and associated GUIDs.

24.6k
repo stars
▌
conducting-domain-persistence-with-dcsync · mukul975 bundle
Extract Active Directory credentials via DCSync attacks and establish domain persistence by dumping KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

24.6k
repo stars
▌
executing-active-directory-attack-simulation · mukul975 bundle
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise.

24.6k
repo stars
▌
performing-active-directory-penetration-test · mukul975 bundle
Enumerate Active Directory domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.

24.6k
repo stars
▌
performing-active-directory-compromise-investigation · mukul975 bundle
Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.

24.6k
repo stars
▌
windows-ad · zhaoxuya520 bundle
Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.

12.8k
repo stars

Frequently asked questions

How do I install the hunting-for-dcsync-attacks skill?

Run npx skillmds add mukul975/hunting-for-dcsync-attacks in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the hunting-for-dcsync-attacks skill do?

Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts. It is listed under Security, Coding & Dev Tools, Incident Response on SkillMD.

Is hunting-for-dcsync-attacks safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: executes scripts, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with hunting-for-dcsync-attacks?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is hunting-for-dcsync-attacks free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published hunting-for-dcsync-attacks?

mukul975 (@mukul975) published this skill. Their other Agent Skills are listed on their SkillMD profile.