DCSync
Map the directory replication permissions that can allow an authorized operator to simulate domain-controller credential replication.
Map the directory replication permissions that can allow an authorized operator to simulate domain-controller credential replication.
Requirements
- Directory replication privileges
- Reachability to a domain controller
- Explicit authorization for credential-access testing
Detection
- Monitor replication requests from non-domain-controller systems
- Audit changes to directory replication rights
Remediation
- Restrict replication privileges
- Continuously review high-impact ACL changes and privileged group membership
Common tools
- Impacket
- Mimikatz
- BloodHound