T1003.006 DCSync — Attack Simulation

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data from Active Directory,…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

DCSync (Active Directory)
windows automated command_prompt
Procedure 129efd28-8497-4c87-a1b0-73b9a870ca3e; elevation not declared required; cleanup not declared. Not executed or individually validated.
Run DSInternals Get-ADReplAccount
windows automated powershell
Procedure a0bced08-3fc5-4d8b-93b7-e8344739376e; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows credential-access isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate subtechnique source_mapped

Detection and collection

T1003.006 detection workspace

Attack tools

Mimikatz · S0002

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.