kqlElastic-2.0from elastic/detection-rules

Potential Credential Access via DCSync

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1003 T1003.006 T1078 T1078.002

Rule sourcerules/windows/credential_access_dcsync_replication_rights.toml

host.os.type:"windows" and event.code:"4662" and
  winlog.event_data.Properties:(
    *DS-Replication-Get-Changes* or *DS-Replication-Get-Changes-All* or
    *DS-Replication-Get-Changes-In-Filtered-Set* or *1131f6ad-9c07-11d1-f79f-00c04fc2dcd2* or
    *1131f6aa-9c07-11d1-f79f-00c04fc2dcd2* or *89e95b76-444d-4c62-991a-0facbeda640c*
  ) and winlog.event_data.AccessMask : "0x100" and
  not winlog.event_data.SubjectUserName:(*$ or MSOL_*)