Detection rules › Elastic
FirstTime Seen Account Performing DCSync
This rule identifies when a User Account starts the Active Directory Replication Process for the first time. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
| Persistence | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
| Privilege Escalation | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
| Defense Evasion | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
| Credential Access | T1003 OS Credential Dumping, T1003.006 OS Credential Dumping: DCSync |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 4662 | An operation was performed on an object. |
Stages and Predicates
Stage 1: kql:new_terms
not (winlog.event_data.SubjectUserName:"*$" or winlog.event_data.SubjectUserName:"MSOL_*") and (winlog.event_data.Properties:"1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" or winlog.event_data.Properties:"1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" or winlog.event_data.Properties:"89e95b76-444d-4c62-991a-0facbeda640c" or winlog.event_data.Properties:"DS-Replication-Get-Changes" or winlog.event_data.Properties:"DS-Replication-Get-Changes-All" or winlog.event_data.Properties:"DS-Replication-Get-Changes-In-Filtered-Set")Exclusions
Top-level NOT(...) conjuncts — predicates this rule actively suppresses.
| Stage | Field | Kind | Excluded values |
|---|---|---|---|
| 1 | user | ends_with | $ |
| 2 | user | starts_with | MSOL_ |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
winlog.event_data.Properties | wildcard |
|
Neighbors
Stricter alternatives (narrower than this rule)
The rules below may be useful if you find the current rule is too noisy / lacks specificity.
- Potential Credential Access via DCSync (adds 1 filter)