Skip to content

T1003.006 DCSync

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller’s application programming interface (API)1 2 3 4 to simulate the replication process from a remote domain controller using a technique called DCSync.

Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data5 from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a Golden Ticket for use in Pass the Ticket6 or change an account’s password as noted in Account Manipulation.7

DCSync functionality has been included in the “lsadump” module in Mimikatz.8 Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.9

Item Value
ID T1003.006
Sub-techniques T1003.001, T1003.002, T1003.003, T1003.004, T1003.005, T1003.006, T1003.007, T1003.008
Tactics TA0006
Platforms Windows
Permissions required Administrator
Version 1.0
Created 11 February 2020
Last Modified 22 April 2021

Procedure Examples

ID Name Description
G1006 Earth Lusca Earth Lusca has used a DCSync command with Mimikatz to retrieve credentials from an exploited controller.18
G1004 LAPSUS$ LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.19
S0002 Mimikatz Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync.148151617
C0014 Operation Wocao During Operation Wocao, threat actors used Mimikatz‘s DCSync to dump credentials from the memory of the targeted system.23
C0024 SolarWinds Compromise During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.212220

Mitigations

ID Mitigation Description
M1015 Active Directory Configuration Manage the access control list for “Replicating Directory Changes” and other permissions associated with domain controller replication.513
M1027 Password Policies Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
M1026 Privileged Account Management Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

Detection

ID Data Source Data Component
DS0026 Active Directory Active Directory Object Access
DS0029 Network Traffic Network Traffic Content

References

  1. Microsoft. (2017, December 1). MS-DRSR Directory Replication Service (DRS) Remote Protocol. Retrieved December 4, 2017. ↩

  2. Microsoft. (n.d.). IDL_DRSGetNCChanges (Opnum 3). Retrieved December 4, 2017. ↩

  3. SambaWiki. (n.d.). DRSUAPI. Retrieved December 4, 2017. ↩

  4. Wine API. (n.d.). samlib.dll. Retrieved December 4, 2017. ↩

  5. Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved August 7, 2017. ↩↩

  6. Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved August 7, 2017. ↩

  7. Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017. ↩

  8. Deply, B., Le Toux, V. (2016, June 5). module ~ lsadump. Retrieved August 7, 2017. ↩↩

  9. Microsoft. (2017, December 1). MS-NRPC - Netlogon Remote Protocol. Retrieved December 6, 2017. ↩

  10. Microsoft. (n.d.). MS-SAMR Security Account Manager (SAM) Remote Protocol (Client-to-Server) - Transport. Retrieved December 4, 2017. ↩

  11. Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved December 4, 2017. ↩

  12. Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved December 4, 2017. ↩

  13. Microsoft. (n.d.). How to grant the “Replicating Directory Changes” permission for the Microsoft Metadirectory Services ADMA service account. Retrieved December 4, 2017. ↩

  14. Deply, B. (n.d.). Mimikatz. Retrieved September 29, 2015. ↩

  15. Grafnetter, M. (2015, October 26). Retrieving DPAPI Backup Keys from Active Directory. Retrieved December 19, 2017. ↩

  16. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019. ↩

  17. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. ↩

  18. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022. ↩

  19. MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022. ↩

  20. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩

  21. Microsoft 365 Defender Team. (2020, December 28). Using Microsoft 365 Defender to protect against Solorigate. Retrieved January 7, 2021. ↩

  22. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021. ↩

  23. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩