Mimikatz DC Sync
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects Mimikatz DC sync security events
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Operation Performed on Object" AND (PROPERTIES contains "Replicating Directory Changes All,1131f6ad-9c07-11d1-f79f-00c04fc2dcd2,1131f6aa-9c07-11d1-f79f-00c04fc2dcd2,9923a32a-3607-11d2-b9be-0000f87a36b2,89e95b76-444d-4c62-991a-0facbeda640c" AND ACCESSMASK = "0x100") AND (DOMAIN != "Window Manager" AND USERNAME notstartswith "NT AUT,MSOL_" AND USERNAME notendswith "$") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.ACCESSES,Action1.OBJECTNAME,Action1.OBJECTTYPE
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Benjamin Delpy, Florian Roth (Nextron Systems), Scott Dermott, Sorina Ionescu
