Sigma rule: Suspicious Machine Account Replication - DcSync Indicator

Rule

Title

Suspicious Machine Account Replication - DcSync Indicator

Status

test

Level

medium

Author

Benjamin Delpy, Florian Roth (Nextron Systems), Scott Dermett, Sorina Ionescu

Date

2018-06-03

Modified

2026-07-30

File

rules/windows/builtin/security/win_security_ad_replication_machine_account.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious Active Directory Replication Service (ADRS) requests originating from
a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.

Under normal operation, only Domain Controllers initiate replication requests carrying the
DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
credentials — for example by abusing certificate-based authentication (PKINIT) to
impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
where a temporary machine account is created to request a DC certificate and then used to
perform DCSync — they can dump all domain credential material including the krbtgt hash.

Log source

product

windows

service

security

definition

Requirements: A SACL must be configured on the domain NC root object (e.g. DC=domain,DC=com) to generate Event 4662. Add via ADSI Edit: navigate to the domain NC root → Properties → Security → Advanced → Auditing → add an ACE for Everyone, Type: Success, Applies to: This object only, rights: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. The OS audit subcategory must also be enabled: auditpol /set /subcategory:"Directory Service Access" /success:enable

Detection

selection:
    EventID: 4662
    Properties|contains:
        - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes-All
        - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes
        - '9923a32a-3607-11d2-b9be-0000f87a36b2' # DS-Replication-Synchronize
        - '89e95b76-444d-4c62-991a-0facbeda640c' # DS-Replication-Get-Changes-In-Filtered-Set
    SubjectUserName|endswith: '$'
filter_main_subject_usersid:
    SubjectUserSid|startswith: 'S-1-5-18'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Valid DC Sync that is not covered by the filters; please report

Tags

• attack.credential-access
• attack.s0002
• attack.t1003.006
• cve.2026-54121

CVEs this rule names

• CVE-2026-54121

MITRE ATT&CK ids this rule names

• S0002
• T1003.006

Related rules

• 17d619c1-e020-4347-957e-1d1207455c93 (similar)

References

• https://twitter.com/gentilkiwi/status/1003236624925413376
• https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
• https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r
• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
• https://github.com/aniqfakhrul/CVE-2026-54121

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_ad_replication_machine_account.yml