Sigma rule: Active Directory Replication from Non Machine Account - DcSync Indicator

Rule

Title

Active Directory Replication from Non Machine Account - DcSync Indicator

Status

test

Level

medium

Author

Roberto Rodriguez @Cyb3rWard0g

Date

2019-07-26

Modified

2026-07-30

File

rules/windows/builtin/security/win_security_ad_replication_non_machine_account.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

Log source

product

windows

service

security

definition

Requirements: A SACL must be configured on the domain NC root object (e.g. DC=domain,DC=com) to generate Event 4662. Add via ADSI Edit: navigate to the domain NC root → Properties → Security → Advanced → Auditing → add an ACE for Everyone, Type: Success, Applies to: This object only, rights: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. The OS audit subcategory must also be enabled: auditpol /set /subcategory:"Directory Service Access" /success:enable

Detection

selection:
    EventID: 4662
    Properties|contains:
        - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes-All
        - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes
        - '9923a32a-3607-11d2-b9be-0000f87a36b2' # DS-Replication-Synchronize
        - '89e95b76-444d-4c62-991a-0facbeda640c' # DS-Replication-Get-Changes-In-Filtered-Set
filter_main_machine_accounts:
    SubjectUserName|endswith: '$'
filter_optional_subject_domain:
    SubjectDomainName: 'Window Manager'
filter_optional_subject_usersid:
    SubjectUserName|startswith:
        - 'NT AUT'
        - 'MSOL_' # https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-accounts-permissions#ad-ds-connector-account
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.t1003.006

MITRE ATT&CK ids this rule names

• T1003.006

Related rules

• 611eab06-a145-4dfa-a295-3ccc5c20f59a (similar)

References

• https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
• https://threathunterplaybook.com/library/windows/active_directory_replication.html
• https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_ad_replication_non_machine_account.yml