Windows Security 4662: Active Directory replication request from non-machine account

title: "Windows Security 4662: Active Directory replication request from non-machine account"
id: 55ac56ea-144d-4eff-b941-1b2993cd1ff4
status: test
description: This rule flags Windows Security events (EventID 4662) where directory access indicates an Active Directory Replication operation, but the requesting subject account is not a machine account (does not end with '$' and excludes MSOL_ accounts). Such replication requests from user or service accounts can be used to obtain directory data and potentially support credential access and lateral movement. The detection relies on auditing of object access (AccessMask 0x100) and matching the replication-related property GUIDs in the event record, along with subject account naming patterns.
references:
  - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
  - https://threathunterplaybook.com/library/windows/active_directory_replication.html
  - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ad_replication_non_machine_account.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-07-26
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1003.006
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    AccessMask: "0x100"
    Properties|contains:
      - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
      - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
      - 89e95b76-444d-4c62-991a-0facbeda640c
  filter:
    - SubjectUserName|endswith: $
    - SubjectUserName|startswith: MSOL_
  condition: selection and not filter
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 17d619c1-e020-4347-957e-1d1207455c93
    type: derived