DCSync attack via DRS GetNCChanges from non-DC source (T1003.006)
Detects unauthorized Active Directory replication requests (DCSync) by monitoring Event ID 4662 for specific directory replication GUIDs originating from computers not identified as domain controllers or by accounts not pre-approved for replication tasks.
Splunk (SPL)
