Windows Security 4662 Detects Mimikatz-style DC Sync Directory Replication Access

Flags Windows EventID 4662 directory replication permission events matching DC Sync–related GUIDs and properties while excluding common service accounts.

FreeUnreviewedSigmahighv1

windows-security-4662-detects-mimikatz-style-dc-sync-directory-replication-acces-611eab06

title: Windows Security 4662 Detects Mimikatz-style DC Sync Directory Replication Access
id: 3585eeee-fde4-4cd3-9180-0a06cc43dd6a
status: test
description: This rule identifies Windows Security auditing events (EventID 4662) where access to replication-related objects matches the “Replicating Directory Changes All” and specific directory change identifier GUIDs, with AccessMask set to 0x100. It is designed to surface DC Sync-style credential access behavior associated with tooling such as Mimikatz that attempts to read directory replication data. The detection relies on Windows Security log telemetry, including the object/property strings in the event and the subject account attributes filtered to reduce common non-user noise.
references:
  - https://twitter.com/gentilkiwi/status/1003236624925413376
  - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
  - https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dcsync.yml
author: Benjamin Delpy, Florian Roth (Nextron Systems), Scott Dermott, Sorina Ionescu, Huntrule Team
date: 2018-06-03
modified: 2022-04-26
tags:
  - attack.credential-access
  - attack.s0002
  - attack.t1003.006
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    Properties|contains:
      - Replicating Directory Changes All
      - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
      - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
      - 9923a32a-3607-11d2-b9be-0000f87a36b2
      - 89e95b76-444d-4c62-991a-0facbeda640c
    AccessMask: "0x100"
  filter1:
    SubjectDomainName: Window Manager
  filter2:
    SubjectUserName|startswith:
      - NT AUT
      - MSOL_
  filter3:
    SubjectUserName|endswith: $
  condition: selection and not 1 of filter*
falsepositives:
  - Valid DC Sync that is not covered by the filters; please report
  - Local Domain Admin account used for Azure AD Connect
level: high
license: DRL-1.1
related:
  - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a
    type: derived

What it detects

This rule identifies Windows Security auditing events (EventID 4662) where access to replication-related objects matches the “Replicating Directory Changes All” and specific directory change identifier GUIDs, with AccessMask set to 0x100. It is designed to surface DC Sync-style credential access behavior associated with tooling such as Mimikatz that attempts to read directory replication data. The detection relies on Windows Security log telemetry, including the object/property strings in the event and the subject account attributes filtered to reduce common non-user noise.

Known false positives

Valid DC Sync that is not covered by the filters; please report
Local Domain Admin account used for Azure AD Connect

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.