DCSync Replication Rights (4662) from Non-DC Host

Ibrahim Saud@tektrix

•updated 6 days ago•0•0•0

Detects Windows Event 4662 indicating the use of DS-Replication-Get-Changes or DS-Replication-Get-Changes-All extended rights from a host that is not a known domain controller. This behavior is highly indicative of credential dumping via DCSync, commonly associated with tools like Mimikatz.