Windows Security: AD object replication attempted by non-machine account (Event ID 4662)

Alerts on AD replication-related object access events where the requester is not a machine account.

FreeReviewedSigma · Critical · v2

Product: windows
Service: security
Author: Roberto Rodriguez @Cyb3rWard0g (SigmaHQ), DRL 1.1
Published: 2019-07-26
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.006DCSync
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows Security events (4662) where access rights associated with Active Directory replication are requested using a non-machine account. An attacker could abuse replication permissions to obtain directory data that may help with credential access or further compromise. It relies on telemetry from Event ID 4662, including the access mask value and the object type GUIDs, and it excludes machine and MSOL account patterns from the subject username.

Reporting behind it

Related detections9 linkedT1003.006 — drag to rearrange

Malicious DCSync Domain Replication Credential Theft (via process_creation)

Malicious Exchange Group Membership Change to Perform DCsync Attack (via security)

Suspicious Computer Account Password Reset via net user by UNC1549

Malicious Active Directory Replication Request Indicating DCSync

Malicious Replication Privileges Accessed to Perform DCSync Attack (via security)

Windows PowerShell: DSInternals Get-ADReplAccount Enumeration

Windows Process Creation: Detect Mimikatz Tool and Module Command-Line Usage

Windows System Service Execution of Credential Dumping Tools (Service Control Manager Event 7045)

Windows Security EID 4697 Service Execution of Credential Dumping Tools

Windows Security: AD object replication attempted by non-machine account (Event ID 4662)

Pivot detection · T1003.006 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-4662-active-directory-replication-request-from-non-machine-acco-17d619c1

title: "Windows Security: AD object replication attempted by non-machine account (Event ID 4662)"
id: 55ac56ea-144d-4eff-b941-1b2993cd1ff4
status: test
description: This rule identifies Windows Security events (4662) where access rights associated with Active Directory replication are requested using a non-machine account. An attacker could abuse replication permissions to obtain directory data that may help with credential access or further compromise. It relies on telemetry from Event ID 4662, including the access mask value and the object type GUIDs, and it excludes machine and MSOL account patterns from the subject username.
references:
  - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
  - https://threathunterplaybook.com/library/windows/active_directory_replication.html
  - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ad_replication_non_machine_account.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-07-26
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1003.006
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    AccessMask: "0x100"
    Properties|contains:
      - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
      - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
      - 89e95b76-444d-4c62-991a-0facbeda640c
  filter:
    - SubjectUserName|endswith: $
    - SubjectUserName|startswith: MSOL_
  condition: selection and not filter
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 17d619c1-e020-4347-957e-1d1207455c93
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL