DCSync Attack - DS-Replication Request from Non-DC Host

Ibrahim Saud@tektrix

•updated 6 days ago•0•0•0

Detects an attempt to perform Active Directory replication (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All) initiated by a machine that is not a recognized Domain Controller. This is a common indicator of credential dumping or unauthorized domain information gathering.