critical Sigma Windows

DCSync - Replication From a Non-DC Host

Directory replication rights exercised by a principal that is not a domain controller. If this fires for real, the domain is gone.

Rule source

dcsync-replication-rights.yml

title: DCSync - Directory Replication From Non-DC Host
id: e2c8d6a4-9f13-4b77-8c25-1a4e9b3f6d01
status: stable
description: >
  Directory replication rights exercised by a principal that is not a domain
  controller. In practice this means the whole domain, krbtgt included,
  should be considered compromised.
references:
  - https://attack.mitre.org/techniques/T1003/006/
author: DetectionOps
date: 2026/09/19
logsource:
  product: windows
  service: security
  definition: 'Requires Directory Service Access auditing enabled on domain controllers'
detection:
  selection:
    EventID: 4662
    Properties|contains:
      - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'   # DS-Replication-Get-Changes
      - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'   # DS-Replication-Get-Changes-All
      - '89e95b76-444d-4c62-991a-0facbeda640c'   # Get-Changes-In-Filtered-Set
  filter_domain_controllers:
    SubjectUserName|endswith: '$'
  filter_aad_connect:
    SubjectUserName|startswith: 'MSOL_'
  condition: selection and not 1 of filter_*
fields:
  - SubjectUserName
  - SubjectLogonId
  - ObjectName
falsepositives:
  - Azure AD Connect sync account - allowlist explicitly, then monitor it harder
  - Legitimate DC-to-DC replication
level: critical
tags:
  - attack.credential_access
  - attack.t1003.006

Required telemetry

Windows Security - Event ID 4662 (DS access auditing required)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Azure AD Connect sync account - allowlist explicitly, then monitor it harder
Legitimate DC-to-DC replication (filtered by machine account)

Validation

Atomic Red Team T1003.006-1 from a member server with delegated rights

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.