Most Popular Detection 2026: DCSync Replication Request from Non-Domain-Controller Host
Detects Active Directory DCSync replication requests by monitoring for Event ID 4662 associated with DS-Replication-Get-Changes or DS-Replication-Get-Changes-All extended rights. The rule triggers when these rights are requested by an entity (subject) originating from a host that is not recognized as a Domain Controller.
Microsoft Sentinel (KQL)
