DCSync Directory Replication Request (Event 4662 DS-Replication-Get-Changes-All)

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects unauthorized directory service access requests (Event ID 4662) utilizing the 'DS-Replication-Get-Changes' or 'DS-Replication-Get-Changes-All' extended rights GUIDs. These rights are required for the DCSync technique used by tools like Mimikatz or Impacket to replicate Active Directory data. The rule specifically flags when such requests originate from a non-domain controller host, which is a strong indicator of credential theft or unauthorized replication attempts.