1200KM / detection
T1003.006 DCSync — Detection Rules
Detection workspace for T1003.006 DCSync: 7 Sigma sources, 1 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Active Directory Replication from Non Machine Account · test · critical · {"product":"windows","service":"security"}
- Mimikatz DC Sync · test · high · {"product":"windows","service":"security"}
- Credential Dumping Tools Service Execution - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
- Credential Dumping Tools Service Execution - System · test · high · {"product":"windows","service":"system"}
- Mimikatz Use · test · high · {"product":"windows"}
- Suspicious Get-ADReplAccount · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
- HackTool - Mimikatz Execution · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
T1003.006 DCSync
MATCH(directory_replication_request) AND source_host NOT_IN approved_domain_controllers -> ALERTAnomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0594 Detection of Unauthorized DCSync Operations via Replication API Abuse
AN1632 Analytic 1632
Detects unauthorized invocation of replication operations (DCSync) via Directory Replication Service (DRS), often executed by threat actors using Mimikatz or similar tools from non-DC endpoints.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.