hunting-for-dcsync-attacks
Lets your agent detect DCSync attacks that steal credentials. It's useful when investigating credential theft or after detecting tools like Mimikatz.
What it does
This tool looks for attempts to steal network administrator passwords. It analyzes specific Windows event logs to identify suspicious activity that might indicate someone is trying to extract security information from your system.
When to use it
- ✓When you suspect someone is trying to steal administrator passwords.
- ✓If you've detected tools that can steal passwords, like Mimikatz.
- ✓During security investigations or tests to see if your network is protected against attacks.
Example of what to ask your AI
“Look for administrator password theft activities.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The tool checks Windows event logs (ID 4662) that record when someone tries to access important data. It looks for specific requests used to copy security information, but only if these requests come from a computer that shouldn't be doing it.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-dcsync-attacksOr download just the file:
curl -L https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/main/skills/hunting-for-dcsync-attacks/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Hunting for DCSync Attacks
When to Use
- When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)
- After detecting Mimikatz or similar tools in the environment
- During incident response involving Active Directory compromise
- When monitoring for unauthorized domain replication requests
- During purple team exercises testing AD attack detection
Prerequisites
- Windows Security Event Log forwarding enabled (Event ID 4662)
- Audit Directory Service Access enabled via Group Policy
- Domain Computers SACL configured on Domain Object for machine account detection
- SIEM with Windows event data ingested (Splunk, Elastic, Sentinel)
- Knowledge of legitimate domain controller accounts and replication partners
Workflow
- Enable Auditing: Ensure Audit Directory Service Access is enabled on domain controllers.
- Collect Events: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access).
- Filter Replication GUIDs: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
- Identify Non-DC Sources: Flag events where SubjectUserName is not a domain controller machine account.
- Correlate with Network: Cross-reference source IPs against known DC addresses.
- Validate Findings: Exclude legitimate replication tools (Azure AD Connect, SCCM).
- Respond: Disable compromised accounts, reset krbtgt, investigate lateral movement.
Key Concepts
| Concept | Description |
|---|---|
| DCSync | Technique abusing AD replication protocol to extract password hashes |
| Event ID 4662 | Directory Service Access audit event |
| DS-Replication-Get-Changes | GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 |
| DS-Replication-Get-Changes-All | GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 |
| AccessMask 0x100 | Control Access right indicating extended rights verification |
| T1003.006 | OS Credential Dumping: DCSync |
Tools & Systems
| Tool | Purpose |
|---|---|
| Windows Event Viewer | Direct event log analysis |
| Splunk | SIEM correlation of Event 4662 |
| Elastic Security | Detection rules for DCSync patterns |
| Mimikatz lsadump::dcsync | Attack tool used to perform DCSync |
| Impacket secretsdump.py | Python-based DCSync implementation |
| BloodHound | Identify accounts with replication rights |
Output Format
Hunt ID: TH-DCSYNC-[DATE]-[SEQ]
Technique: T1003.006
Domain Controller: [DC hostname]
Subject Account: [Account performing replication]
Source IP: [Non-DC IP address]
GUID Accessed: [Replication GUID]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Disable account, reset krbtgt, investigate]
FAQ
What is DCSync?
DCSync is a technique that abuses the Active Directory replication protocol to extract user and administrator password hashes.
What are Event ID 4662 logs?
These are Windows logs that record when access occurs to directory service objects, like Active Directory.
Why is it important to identify non-domain controller accounts?
Because only domain controllers should be allowed to perform certain replication operations. If another account attempts it, it could be a credential theft attempt.
Details
Original description by the author
Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abu
Popularity
- GitHub stars
- 35k
- Ranking position
- #5792
- License
- Apache-2.0
- Updated
- 8/31/2026
Comments
- …
More skills from this repository
abusing-dpapi-for-credential-access
Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.
mukul975/Anthropic-Cybersecurity-Skills
abusing-shadow-credentials-for-privesc
Teaches your AI agent to write clear, well-structured text.
mukul975/Anthropic-Cybersecurity-Skills
achieving-cmmc-level-2-compliance
Helps your agent prepare an environment for CMMC Level 2 compliance. It implements security requirements and manages necessary documentation.
mukul975/Anthropic-Cybersecurity-Skills
acquiring-disk-image-with-dd-and-dcfldd
Helps your agent create exact copies of hard drives. This is useful for ensuring no information is lost or altered during investigations.
mukul975/Anthropic-Cybersecurity-Skills
Similar skills
data-throughput-accelerator
Makes your agent speed up the movement of large data volumes. It finds bottlenecks and ensures data is transferred quickly and correctly.
affaan-m/ECC
inventory-demand-planning
Helps your agent predict product demand in stores. It optimizes stock and plans when to run promotions to sell more.
affaan-m/ECC
market-research
Helps your agent conduct market research and competitive analysis. Provides summaries with source attribution.
affaan-m/ECC