DCSync and the abuse of replication rights
In the security log you separate replication requests (4662) from the DCs’ own traffic, recognise the replication GUIDs, find the account, computer and time of the request and turn the detection into a script; in the directory you catch, with lmos-acl, the replication rights given to that account on the domain’s top object, compare them with the legitimate holders and write the response plan (krbtgt included). The account, computer and time differ in every lab.
Level 201 · 50 min
DCs pass changes to each other through replication. One DC asks another: "send me the latest changes, password hashes included". This request needs two extended rights on the domain’s top object: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
In a DCSync attack the attacker takes over an account holding these rights and, acting like a DC from an ordinary computer, asks for every password hash, krbtgt included. With krbtgt’s hash the attacker can forge tickets in anyone’s name (a "golden ticket"). That is why DCSync means the whole domain is compromised.
Traces remain in two places: event 4662 in the DC’s security log (with the replication GUIDs), and the rights in the directory. DCs produce 4662 all the time too; the trick is to single out an account that isn’t a DC. The figure shows the GUIDs and the legitimate holders. You won’t perform the attack; the goal is detection and response. About 30 seconds after the lab starts, this lab’s directory changes are in place.
What you will do in this lesson
- Who produces the 4662s?
- Which operation? The replication GUIDs
- From which computer, and when?
- In the directory: who holds the right?
- The legitimate holders
- Trace it in SDDL: from SID to name
- Write a detection rule
- Record the finding
- The response plan
- Short quiz
Skills you will earn
- Detecting DCSync in replication events (4662)
- Reading and counting a security log with jq
- Answering who, whom, from where and when for an incident
- Auditing DCSync (replication) rights
- Reading an AD object’s permissions (DACL, ACEs)
- Finding whom a SID belongs to
- Reading permissions in SDDL form
- Turning a detection into a script
- Planning the response after DCSync (ACEs, krbtgt, passwords)
- Writing audit findings into a report
← Detecting and preventing Kerberoasting · Active Directory security: auditing and hardening · The tiered administration model (tier 0/1/2) →
Start for free