Detection of Unauthorized Active Directory Replication by Non-Machine Accounts

This brief addresses the detection of unauthorized Active Directory (AD) replication activity, a technique commonly referred to as DCSync. In a standard, healthy environment, Active Directory replication is performed by Domain Controllers using designated machine accounts. Adversaries leverage the Directory Replication Service (DRS) Remote Protocol to impersonate a domain controller and request the replication of password data for specific domain objects, including user accounts.

When an account that is not a machine account (which typically ends with a '$' sign in Windows) initiates these replication calls, it serves as a high-fidelity indicator of potential credential theft or reconnaissance activity. Defenders must ensure that the appropriate System Access Control List (SACL) is applied to the domain NC root object to trigger the generation of Event ID 4662, which provides the necessary visibility into the specific access rights being invoked.

Impact

Successful abuse of the Directory Replication Service allows an attacker with sufficient privileges to extract password hashes for any user in the domain, including administrative accounts. This leads to complete compromise of the domain identity infrastructure, enabling lateral movement, persistence, and unauthorized access to resources across the enterprise.

Recommendation

• Ensure the "Directory Service Access" audit subcategory is enabled via auditpol.
• Apply a SACL to the domain NC root object to audit access rights for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
• Deploy the provided Sigma rule to monitor for Event ID 4662 originating from non-machine accounts.
• Investigate any alerts generated by this rule immediately, as they indicate a user or service account is attempting to perform domain controller replication tasks.