Techniques
Sample rules
Suspicious Machine Account Replication - DcSync Indicator
- source: sigma
- technicques:
- t1003
- t1003.006
Description
Detects suspicious Active Directory Replication Service (ADRS) requests originating from a machine account (SubjectUserName ending in ‘$’) rather than a legitimate Domain Controller.
Under normal operation, only Domain Controllers initiate replication requests carrying the DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account credentials — for example by abusing certificate-based authentication (PKINIT) to impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost), where a temporary machine account is created to request a DC certificate and then used to perform DCSync — they can dump all domain credential material including the krbtgt hash.
Detection logic
condition: selection and not 1 of filter_main_*
filter_main_subject_usersid:
SubjectUserSid|startswith: S-1-5-18
selection:
EventID: 4662
Properties|contains:
- 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
- 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
- 9923a32a-3607-11d2-b9be-0000f87a36b2
- 89e95b76-444d-4c62-991a-0facbeda640c
SubjectUserName|endswith: $