All Detections

Rogue Domain Controller Replication Request

avatar
Darshan Thummar@Mighty
updated Jun 14, 2026004

Detects unauthorized domain controller replication that may indicate DCSync or rogue DC

Microsoft Sentinel (KQL)