DCSync Attack - Directory Replication Request

Darshan Thummar@Mighty

•updated Jun 10, 2026•6•0•10

This rule detects a DCSync attack by looking for the "DsGetNCChanges" string in TCP traffic on port 389 (LDAP). DCSync is a technique used by attackers to simulate a domain controller and request directory replication, allowing them to extract password hashes and other sensitive information from Active Directory.