DCSync: Mechanics, Prerequisites, and Forensic Artefacts

Concept

Introduced in 2015 by Benjamin Delpy and Vincent Le Toux within Mimikatz (lsadump::dcsync), the DCSync attack abuses Active Directory’s legitimate replication protocol (MS-DRSR - Directory Replication Service Remote Protocol) to remotely extract password hashes, Kerberos keys (AES, RC4), and password histories for any security principal in the directory, most notably krbtgt.

The attack operates entirely through Remote Procedure Calls (RPC) targeting the drsuapi interface (UUID e3514235-4b06-11d1-ab04-00c04fc2dcd2) and requires zero local interactive access to the domain controller.

Why It Matters in DFIR

DCSync represents the decisive turning point transforming an intrusion into unconstrained domain dominance:

Harvesting the Crown Jewel (krbtgt): Extracting the krbtgt key enables adversaries to forge Golden Tickets valid for years, surviving endpoint reimaging and standard password resets.
Absence of Endpoint Execution Signatures on the DC: An investigator searching for suspicious executables, temporary services (Event 7045), or PowerShell logs on the DC will find nothing. Detection relies entirely on Directory Service Access logs (Event ID 4662).
Abuse of Delegated Replication Rights: DCSync is not confined to Domain Admins. Any account granted replication rights (such as Azure AD Connect / Entra ID Connect synchronization accounts) can execute DCSync.

How It Works

Required Extended Rights in Domain Object DACL

For an identity to successfully invoke DCSync, it must possess the following Extended Rights on the domain root object (DC=domain,DC=local):

DS-Replication-Get-Changes (GUID: 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2)
DS-Replication-Get-Changes-All (GUID: 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2)
DS-Replication-Get-Changes-In-Filtered-Set (only required when querying Read-Only Domain Controllers - RODCs).

By default, only the following built-in groups hold these permissions:

Administrators (RID 544)
Domain Admins (RID 512)
Enterprise Admins (RID 519)
Domain Controllers (RID 516)

Attack Protocol Exchange

Attacker (Compromised Endpoint)                 Domain Controller (DC)
   │                                                         │
   │ 1. RPC bind on endpoint mapper (Port 135)               │
   ├────────────────────────────────────────────────────────►│
   │◄────────────────────────────────────────────────────────┤ 2. Allocates dynamic RPC port
   │                                                         │
   │ 3. DRSBind (Interface drsuapi on dynamic port)          │
   ├────────────────────────────────────────────────────────►│
   │◄────────────────────────────────────────────────────────┤ 4. Replication context confirmed
   │                                                         │
   │ 5. DRSGetNCChanges (Requests "krbtgt" replica)          │
   ├────────────────────────────────────────────────────────►│
   │                                                         │ 6. Validates Extended Rights in DACL
   │                                                         │    Generates Event ID 4662
   │◄────────────────────────────────────────────────────────┤ 7. Returns encrypted attributes:
   │                                                         │    - unicodePwd (NT Hash)
   ▼                                                         │    - supplementalCredentials (AES)
Reconstructs Kerberos & NTLM keys                            ▼

What Is Possible

Extracting Credentials Silently Without DC Interruption: The extraction is instantaneous, causing zero disruption or host performance degradation.
Recovering Password Histories: Replicating the ntPwdHistory attribute allows adversaries to analyze historical user password patterns.
Unambiguous Detection When Object Access Auditing Is Active: Event ID 4662 logs precisely timestamp the operation, identifying the requesting account and client network address.

What Is Not Possible

Executing DCSync Without Extended Replication Rights: If the principal lacks DS-Replication-Get-Changes-All, the DC returns ERROR_DS_DRA_ACCESS_DENIED (0x2004).
Executing DCSync When RPC Communication Is Blocked: The attack strictly requires network connectivity to TCP port 135 and dynamic RPC ports on the DC.
Concealing Requesting Account Identities in Event 4662: The SubjectUserName and SubjectUserSid fields faithfully record the identity that initiated DRSGetNCChanges.

Common DFIR Confusions

Frequent Confusion	Verifiable Forensic Reality
”The attacker logged into the DC; we must inspect the DC master boot record and RAM.”	DCSync is executed remotely from a network endpoint. The DC experienced zero interactive intrusion or binary file modifications.
”Only Domain Admins can invoke DCSync.”	False. Directory sync accounts (e.g., `MSOL_...` for Azure AD Connect) hold these permissions by design and represent primary targets.
”DCSync generates interactive logon events (Type 2 or 10).”	No. DCSync produces Logon Type 3 (Network) events over RPC.

Concrete Forensic Example

During post-compromise triage, an investigator reviews Security event logs on primary domain controller DC01:

Querying Event ID 4662:
- Timestamp: 03:22:15 UTC
- SubjectUserName: svc_backup
- ObjectServer: DS
- Properties: {1131f6ad-9c07-11d1-f79f-00c04fc2dcd2} (DS-Replication-Get-Changes-All GUID)
Investigating svc_backup:
- Account is not in Domain Admins, but held historical replication rights delegated months prior for an ad-hoc sync utility.
Correlating Event 4624 Type 3:
- Source IP: 10.10.4.88 (a compromised application server hosting svc_backup plaintext credentials in a web configuration file).
DFIR Finding: The adversary leveraged the service account to execute secretsdump.py and harvest the krbtgt hash. An immediate double krbtgt rotation was initiated.

Key Forensic Artefacts

DC Directory Service Access Logs:
- Event ID 4662: Directory object access.
  - ObjectType: {19195a5b-6da0-11d0-afd3-00c04fd930c9} (domainDNS class).
  - AccessMask: 0x100 (Control Access).
  - Properties: Contains GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2.
- Event ID 4624 (Logon Type 3): Accompanying RPC network logon.
Network Traffic:
- RPC traffic directed to the drsuapi UUID originating from an IP address that is not an authorized domain controller.

Investigation Methods

Audit Domain Replication Permissions in AD: Query the domain root ACL to identify all non-DC accounts possessing DS-Replication-Get-Changes-All.
Filter Event ID 4662 on Domain Controllers: Search for Event 4662 entries containing the replication GUID, excluding legitimate DC machine accounts ending with $.
Identify Client Source Endpoints: Match the Logon ID from Event 4662 with Event 4624 to locate the machine from which the attack was launched.

Investigative Tooling

PowerView:

# Enumerate DCSync-capable principals
Get-DomainObjectAcl -SearchBase "DC=corp,DC=local" -ResolveGUIDs |
  Where-Object { $_.ActiveDirectoryRights -match 'ExtendedRight' -and ($_.SecurityIdentifier -match '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' -or $_.AceQualifier -eq 'AccessAllowed') }

PowerShell Log Query:

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4662} |
  Where-Object { $_.Message -like '*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*' } |
  Select-Object TimeCreated, @{N='Account';E={$_.Properties[1].Value}}

Key Takeaways

DCSync is a network RPC attack (DRSUAPI) without code execution on domain controllers.
It strictly requires DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights.
Telemetry generates Event ID 4662 on the target DC containing the replication Extended Right GUID.
Replication traffic initiated by a non-DC endpoint represents an immediate critical alert.