{"id":"611eab06-a145-4dfa-a295-3ccc5c20f59a","title":"Mimikatz DC Sync","description":"Detects Mimikatz DC sync security events","author":"Benjamin Delpy, Florian Roth (Nextron Systems), Scott Dermott, Sorina Ionescu","status":"test","level":"high","date":"2018-06-03","modified":"2022-04-26","tags":["attack.credential-access","attack.s0002","attack.t1003.006"],"technique_ids":["T1003.006"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Valid DC Sync that is not covered by the filters; please report","Local Domain Admin account used for Azure AD Connect"],"references":["https://twitter.com/gentilkiwi/status/1003236624925413376","https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2","https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662"],"source_path":"rules/windows/builtin/security/win_security_dcsync.yml","source_sha256":"6fbd088349d033ced12675320c6f84bd36d7caba741a9fb19a6bea3390ddf175","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_dcsync.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Mimikatz DC Sync\nid: 611eab06-a145-4dfa-a295-3ccc5c20f59a\nstatus: test\ndescription: Detects Mimikatz DC sync security events\nreferences:\n    - https://twitter.com/gentilkiwi/status/1003236624925413376\n    - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2\n    - https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662\nauthor: Benjamin Delpy, Florian Roth (Nextron Systems), Scott Dermott, Sorina Ionescu\ndate: 2018-06-03\nmodified: 2022-04-26\ntags:\n    - attack.credential-access\n    - attack.s0002\n    - attack.t1003.006\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4662\n        Properties|contains:\n            - 'Replicating Directory Changes All'\n            - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'\n            - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'\n            - '9923a32a-3607-11d2-b9be-0000f87a36b2'\n            - '89e95b76-444d-4c62-991a-0facbeda640c'\n        AccessMask: '0x100'\n    filter1:\n        SubjectDomainName: 'Window Manager'\n    filter2:\n        SubjectUserName|startswith:\n            - 'NT AUT'\n            - 'MSOL_'\n    filter3:\n        SubjectUserName|endswith: '$'\n    condition: selection and not 1 of filter*\nfalsepositives:\n    - Valid DC Sync that is not covered by the filters; please report\n    - Local Domain Admin account used for Azure AD Connect\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.006","id":"T1003.006","name":"DCSync","page":"techniques/enterprise/T1003.006/"}],"data_path":"data/detection-rules/611eab06-a145-4dfa-a295-3ccc5c20f59a.json","kind":"sigma"}