Detects DCSync attacks by analyzing Windows event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain controller accounts. For Active Directory threat hunting.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 狩猎 DCSync 凭据窃取行为（MITRE ATT&CK T1003.006）时
Detects DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts. For threat hunting in Active Directory.
Detects DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-DC accounts. Guides AD threat hunting and incident response.
Detects DCSync attacks in Active Directory by monitoring non-domain controller accounts requesting directory replication via DsGetNCChanges and Event ID 4662. Useful for threat hunting credential theft with Mimikatz or Impacket.
Share bugs, ideas, or general feedback.
| 概念 | 描述 |
|---|---|
| DCSync | 滥用 AD 复制协议提取密码哈希的技术 |
| 事件 ID 4662 | 目录服务访问审计事件 |
| DS-Replication-Get-Changes | GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 |
| DS-Replication-Get-Changes-All | GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 |
| AccessMask 0x100 | 控制访问权限，表示扩展权限验证 |
| T1003.006 | OS 凭据转储：DCSync |
| 工具 | 用途 |
|---|---|
| Windows 事件查看器 | 直接分析事件日志 |
| Splunk | 事件 4662 的 SIEM 关联分析 |
| Elastic Security | DCSync 模式检测规则 |
| Mimikatz lsadump::dcsync | 执行 DCSync 的攻击工具 |
| Impacket secretsdump.py | 基于 Python 的 DCSync 实现 |
| BloodHound | 识别具有复制权限的账户 |
狩猎 ID：TH-DCSYNC-[日期]-[序号]
技术：T1003.006
域控制器：[DC 主机名]
主体账户：[执行复制的账户]
源 IP：[非 DC IP 地址]
访问的 GUID：[复制 GUID]
风险等级：[严重/高/中/低]
建议操作：[禁用账户、重置 krbtgt、展开调查]