Directory replication rights exercised by a non-machine account

Siemphony@siemphonymediumT1003.006unverified

Implements AN1632 on Security EventID 4662: a directory object access in which the control access right exercised is one of the three replication extended rights, requested by a principal whose name does not end in a dollar sign. That pairing is the whole detection. DCSync works by asking a domain controller to replicate secrets through DRSUAPI, and a genuine replication partner is a domain controller presenting its own computer account, so the account-name shape is what separates the tool from the protocol. The three GUIDs are DS-Replication-Get-Changes, DS-Replication-Get-Changes-All and DS-Replication-Get-Changes-In-Filtered-Set; matching any one of them rather than requiring the pair a full secret pull needs keeps the rule on reconnaissance-shaped calls too. Two field-format cautions matter more than the logic. `AccessMask` is written by Windows as the hex string 0x100 for a control access right, so a pipeline that zero-pads it, lower-cases the prefix or converts it to decimal turns this selection permanently false; and `Properties` is a multi-value blob, which is why it is matched with contains rather than by equality. Several limits belong on the face of the rule. MITRE's `SourceIP` knob cannot be applied here at all — 4662 carries no client address field, so "expected replication should only come from known DCs" is not expressible on this event, and neither is the `TimeWindow` correlation the analytic describes, lib/sigma having no timeframe or join. The machine-account filter is also the rule's blind spot: DCSync run under a stolen computer account, or from a compromised domain controller's own identity, is filtered out by design. EventID 4929 from the brief is not used — it records the removal of a replica source naming context, an administrative topology change rather than a secret pull. Prerequisite: 4662 needs *Audit Directory Service Access* enabled for Success on domain controllers and an audit ACE on the domain naming context covering the replication extended rights. DS Access auditing is in the domain controller baseline, but the SACL is worth confirming on the domain object before trusting a quiet result, because if either half is missing the rule returns zero rows and zero rows reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0594, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

SecurityEvent| where ((EventID == 4662 and AccessMask =~ "0x100" and (Properties contains "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" or Properties contains "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" or Properties contains "89e95b76-444d-4c62-991a-0facbeda640c")) and not (SubjectUserName endswith "$"))

Splunk · SPL

Run this as a search.

index=* ((EventID="4662" AND AccessMask="0x100" AND (Properties="*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*" OR Properties="*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*" OR Properties="*89e95b76-444d-4c62-991a-0facbeda640c*")) AND NOT (SubjectUserName="*$"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4662 AND TO_LOWER(AccessMask) == "0x100" AND (TO_LOWER(Properties) LIKE "*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*" OR TO_LOWER(Properties) LIKE "*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*" OR TO_LOWER(Properties) LIKE "*89e95b76-444d-4c62-991a-0facbeda640c*")) AND NOT (TO_LOWER(user.name) LIKE "*$"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4662$</field>    <field name="AccessMask" type="pcre2">(?i)^0x100$</field>    <field name="Properties" type="pcre2">(?i)(1131f6aa-9c07-11d1-f79f-00c04fc2dcd2|1131f6ad-9c07-11d1-f79f-00c04fc2dcd2|89e95b76-444d-4c62-991a-0facbeda640c)</field>    <field name="SubjectUserName" negate="yes" type="pcre2">(?i)\$$</field>    <description>Directory replication rights exercised by a non-machine account</description>    <mitre>      <id>T1003.006</id>    </mitre>  </rule></group>

At a glance

Logsource: security / windows
Level: medium
Category: credential_dump
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 3e1db1cb-d351-420a-96cc-3d6d1259a31f

ATT&CKT1003.006

T1003.006DCSync

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessoncredential dump

credential dumpAI draft — unreviewed

01 · What this rule detects

The rule is "Directory replication rights exercised by a non-machine account", written against MITRE analytic AN1632. DCSync does not touch LSASS or the NTDS file at all — it asks a domain controller, over DRSUAPI, to replicate secrets to the caller, exactly as one DC asks another. Because the protocol itself is legitimate, the rule cannot detect the call; it detects the caller. A genuine replication partner is a domain controller presenting its own computer account, so the shape of the requesting principal is the discriminator the whole rule rests on.

02 · Telemetry you need

Windows Security EventID 4662 from domain controllers. Two prerequisites, and both are silent when missing: Audit Directory Service Access must be enabled for Success, and an audit ACE must exist on the domain naming context covering the replication extended rights. DS Access auditing is in the Microsoft DC baseline; the SACL on the domain object is worth confirming by hand, because if either half is absent the rule returns zero rows and zero rows reads as quiet when it means blind. EventID 4929 also appears in the brief and is not used — it records removal of a replica source naming context, a topology change rather than a secret pull.

03 · How the logic works

One selection and one filter. selection requires EventID: 4662, AccessMask: '0x100' (Windows' hex string for a control access right), and Properties|contains any of three extended-right GUIDs: DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes-In-Filtered-Set. Properties is a multi-value blob, which is why it is matched with contains rather than equality. Matching any one GUID rather than the pair a full secret pull needs keeps reconnaissance-shaped calls in scope; the filtered-set GUID is a widening the pipeline added, not part of the DCSync call pair. filter_machine_account then drops every event whose SubjectUserName ends in $, and the condition is selection and not filter_machine_account. MITRE's SourceIP knob is inapplicable here — 4662 carries no client address field — and its TimeWindow correlation has no expression in lib/sigma.

04 · Common false positives

The dominant match is Microsoft Entra Connect. With password hash sync enabled its directory synchronisation account holds both replication rights and exercises them every two minutes on the default schedule, under an MSOL_<hex> name that has no trailing $ and therefore survives the filter. Password-auditing tools (DSInternals, Specops, Purple Knight) pull hashes through the same API on purpose. Migration products such as Quest and BinaryTree do it in sustained bursts during a cutover, and some PAM and identity-threat platforms request replication rights at deployment.

05 · Detection maturity

tier_1: Lowest tier. Nothing here has been executed against a log line — no confirmed field names for your pipeline, no measured volume, no tuning history. It sits at the bottom until it has run against real 4662 traffic on your own domain controllers.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Two changes matter before this runs anywhere. First, exclude the sync account by name — that is precisely what MITRE's UserContext knob is for — because as shipped, on a password-hash-sync tenant, this is a continuous alert forever and the medium level assumes a tuning step the YAML does not encode. Second, review recommends replacing the $ filter with an enumerated allowlist of your actual DC computer accounts: the name-shape filter discards the entire machine-account DCSync class, including NTLM relay to LDAP and attacker-created computer accounts under the default MachineAccountQuota — the modern default path, not an edge case. Also watch AccessMask: the raw form is 0x100, but Winlogbeat, several Splunk TAs and ECS normalisation may zero-pad, lower-case or decimalise it, which makes the selection permanently false. The three GUIDs are specific enough to carry the rule if you drop that term.

Declared by the author

The directory synchronisation account of Microsoft Entra Connect. With password hash sync enabled it holds Replicate Directory Changes and Replicate Directory Changes All and exercises them continuously — every two minutes on the default schedule — under a user account such as MSOL_<hex> that does not end in a dollar sign and so survives the filter. On any tenant using password hash sync this is the highest-volume match by a wide margin. It is one enumerable, statically named principal rather than a class of users, which is why the level is medium rather than low, and excluding it by name is what MITRE's UserContext knob is for.
Password-auditing and directory-assessment tooling run by the identity team. DSInternals Get-ADReplAccount, Specops Password Auditor, Semperis Purple Knight and equivalent products pull hashes through the same replication API on purpose, typically on a weekly or monthly schedule from an administrator workstation, and the event is byte-for-byte what an attack produces.
Directory migration and coexistence products during a cutover. Quest Migration Manager, BinaryTree and similar tools are granted replication rights so they can move password data between forests, and they exercise them in sustained bursts for the duration of a migration window.
Third-party identity and security platforms that ingest directory data — some privileged access management, password-breach detection and identity-threat products request replication rights at deployment, so the first match after a new tool is installed is a change-management question rather than an incident.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1003.006, evaluated against their — events.

Share this rule

/u/siemphony/3e1db1cb-d351-420a-96cc-3d6d1259a31f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Directory replication rights exercised by a non-machine account

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it