Most Popular Detection 2026 – DCSync Replication Request from Non-DC Host
Detects Microsoft Windows Event ID 4662 (Object Access) where specific GUIDs associated with sensitive Active Directory rights (specifically, those related to DCSync or sensitive extended rights) are accessed. The rule filters out events originating from Domain Controllers to identify potentially anomalous access patterns from non-DC endpoints.
Cortex XDR
