Suspicious DRSGetNCCChange Request From Unmanaged or Non-DC Device - Zeek
Detects instances where a host that is not identified as a Domain Controller performs a DRSUAPI 'DRSGetNCChanges' request against another Domain Controller. This pattern is commonly associated with DCSync attacks, where an adversary mimics the Active Directory replication process to extract password hashes.
Cortex XDR
