Detection of DSInternals Get-ADReplAccount Usage

The DSInternals PowerShell module is a powerful toolkit designed for Active Directory and Azure Active Directory auditing. While it serves legitimate administrative and security research purposes, it is also highly valued by attackers for its ability to extract credentials, manipulate offline NTDS.dit files, and perform password hash calculations. Specifically, the Get-ADReplAccount cmdlet is often utilized to retrieve account objects and their associated secrets directly from a domain controller. Detection is critical as the use of this cmdlet in a production environment by unauthorized users or non-standard administrative accounts is a strong indicator of credential access activities, particularly during the post-exploitation phase when an actor attempts to harvest domain secrets.

Impact

Successful use of this tool allows an adversary to obtain sensitive account information and password hashes. If exploited, this leads to complete domain compromise, allowing the attacker to perform pass-the-hash attacks, escalate privileges, or maintain persistent access to the enterprise identity infrastructure.

Recommendation

Detection engineering teams should implement PowerShell Script Block Logging (Event ID 4104) and deploy the provided detection rule to identify the execution of the Get-ADReplAccount command. Because the tool can be used for authorized auditing, alerts should be tuned against known administrative workstations and service accounts performing scheduled domain audits.

• Enable PowerShell Script Block Logging (Event ID 4104) across all Domain Controllers and high-value internal workstations to capture script execution details.
• Deploy the Sigma rule provided below to SIEM to identify suspicious credential access attempts.
• Correlate alerts with account authorization logs to determine if the activity is performed by sanctioned administrative staff.