Storm-0501G1053 ↗
Has utilized DCSync to extract credentials from victims.1
- Tactic
- Credential Access
- Platform
- Windows
- Version
- 1.1
- Created
- 11 February 2020
- Last modified
- 24 October 2025
- Contributors
- ExtraHop; Vincent Le Toux
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.10
Detection rules74th pct
Detection rules74th percentile · 74% of ATT&CK techniques have this many detection rules written or fewer.DCSync MITRE reference T1003.006
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Earth LuscaG1006 ↗
Has used a DCSync command with Mimikatz to retrieve credentials from an exploited controller.1
LAPSUS$G1004 ↗
Has used DCSync attacks to gather credentials for privilege escalation routines.1
Mustang PandaG0129 ↗
Has leveraged Mimikatz DCSync feature to obtain user credentials.1
All 4 groups for this technique
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0027C0027 ↗
During C0027, Scattered Spider performed domain replication.1
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.123
Operation WocaoC0014 ↗
During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.1
All 3 campaigns for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MimikatzS0002 ↗
Performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync.12345
All 1 software entries for this technique
Offense vs defense T1003.006
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 3Sigma rules (cumulative) · 7Splunk ESCU (cumulative) · 3
first rule: 2017 Q1 · 3 of 3 campaigns plottedDCSync detection strategy DET0594
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Unauthorized DCSync Operations via Replication API Abuse
1 platform
AN1632 · Windows
Detects unauthorized invocation of replication operations (DCSync) via Directory Replication Service (DRS), often executed by threat actors using Mimikatz or similar tools from non-DC endpoints.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Active Directory Object DeletionDC0068 | WinEventLog:Security | EventCode=4929 |
| Active Directory Object AccessDC0071 | WinEventLog:Security | EventCode=4662 |
| Network Traffic ContentDC0085 | NSM:Content | Traffic on RPC DRSUAPI |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Defines the correlation window for unusual account access followed by DRSUAPI traffic. |
| UserContext | Allows tuning for specific accounts known to legitimately request replication. |
| SourceIP | Expected replication should only come from known DCs; this field allows excluding trusted DCs. |
Manage the access control list for "Replicating Directory Changes" and other permissions associated with domain controller replication.
Password PoliciesM1027
Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
Tests2Executorscmd 1 · PowerShell 1Need elevation0 of 2Have prerequisites2Have cleanup0Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | DCSync (Active Directory) | windows | cmd | — | 1 | — | ||||||||||||||||||
Active Directory attack allowing retrieval of account information without accessing memory or retrieving the NTDS database. Works against a remote Windows Domain Controller using the replication protocol. Privileges required: domain admin or domain controller account (by default), or any other account with required rights. Reference Input arguments
Attack command #{mimikatz_path} "lsadump::dcsync /domain:#{domain} /user:#{user}@#{domain}" "exit"
Prerequisite Mimikatz executor must exist on disk and at specified location (#{mimikatz_path}) Check $mimikatz_path = cmd /c echo #{mimikatz_path}
if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
Satisfy [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
$releases = "https://api.github.com/repos/gentilkiwi/mimikatz/releases"
$zipUrl = (Invoke-WebRequest $releases | ConvertFrom-Json)[0].assets.browser_download_url | where-object { $_.endswith(".zip") }
$mimikatz_exe = cmd /c echo #{mimikatz_path}
$basePath = Split-Path $mimikatz_exe | Split-Path
Invoke-FetchFromZip $zipUrl "x64/mimikatz.exe" $basePath
GUID4ee71a38-adc8-4074-be1f-f27ee44bfa5d | ||||||||||||||||||||||||
| 02 | Run DSInternals Get-ADReplAccount | windows | PowerShell | — | 1 | — | ||||||||||||||||||
The following Atomic will run Get-ADReplAccount from DSInternals. Upon successful execution, domain and credentials will appear in stdout. Reference CrowdStrike StellarParticle. https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/ Input arguments
Attack command Get-ADReplAccount -All -Server #{logonserver}
Prerequisite DSInternals must be installed Check $RequiredModule = Get-Module -Name DSInternals -ListAvailable
if (-not $RequiredModule) {exit 1} else {exit 0}
Satisfy Install-Module -Name DSInternals -Scope CurrentUser -Force GUID7553a570-546f-4bf8-a106-18ca2e773573 | ||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition