Windows PowerShell: DSInternals Get-ADReplAccount Enumeration

Alerts on PowerShell execution of Get-ADReplAccount with -All and -Server parameters for AD replication account enumeration.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-02-06
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.006DCSync
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script block content that includes a Get-ADReplAccount call with -All and -Server parameters. Such enumeration can help an attacker gather Active Directory replication account information for credential access and further targeting. It relies on Script Block Logging telemetry that captures the executed PowerShell command text.

Reporting behind it

Related detections9 linkedT1003.006 — drag to rearrange

Malicious DCSync Domain Replication Credential Theft (via process_creation)

Malicious Exchange Group Membership Change to Perform DCsync Attack (via security)

Suspicious Computer Account Password Reset via net user by UNC1549

Malicious Active Directory Replication Request Indicating DCSync

Malicious Replication Privileges Accessed to Perform DCSync Attack (via security)

Windows Process Creation: Detect Mimikatz Tool and Module Command-Line Usage

Windows Security: AD object replication attempted by non-machine account (Event ID 4662)

Windows System Service Execution of Credential Dumping Tools (Service Control Manager Event 7045)

Windows Security EID 4697 Service Execution of Credential Dumping Tools

Windows PowerShell: DSInternals Get-ADReplAccount Enumeration

Pivot detection · T1003.006 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-suspicious-get-adreplaccount-enumeration-with-all-and-server--060c3ef1

title: "Windows PowerShell: DSInternals Get-ADReplAccount Enumeration"
id: 1b621876-90fb-4027-8d8d-af942adce4fb
status: test
description: This rule flags PowerShell script block content that includes a Get-ADReplAccount call with -All and -Server parameters. Such enumeration can help an attacker gather Active Directory replication account information for credential access and further targeting. It relies on Script Block Logging telemetry that captures the executed PowerShell command text.
references:
  - https://www.powershellgallery.com/packages/DSInternals
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.006/T1003.006.md#atomic-test-2---run-dsinternals-get-adreplaccount
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml
author: frack113, Huntrule Team
date: 2022-02-06
tags:
  - attack.credential-access
  - attack.t1003.006
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Get-ADReplAccount
      - "-All "
      - "-Server "
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
  - id: 060c3ef1-fd0a-4091-bf46-e7d625f60b73
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL