kqlElastic-2.0from elastic/detection-rules

FirstTime Seen Account Performing DCSync

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1003 T1003.006 T1078 T1078.002

Rule sourcerules/windows/credential_access_dcsync_newterm_subjectuser.toml

event.code:"4662" and host.os.type:"windows" and 
  winlog.event_data.Properties:(
    *DS-Replication-Get-Changes* or *DS-Replication-Get-Changes-All* or
    *DS-Replication-Get-Changes-In-Filtered-Set* or *1131f6ad-9c07-11d1-f79f-00c04fc2dcd2* or
    *1131f6aa-9c07-11d1-f79f-00c04fc2dcd2* or *89e95b76-444d-4c62-991a-0facbeda640c*) and
  not winlog.event_data.SubjectUserName:(*$ or MSOL_*)