Operation on an Active Directory object. AccessMask and ObjectType are key. Requires SACL on AD objects.
DCSync uses replication rights GUIDs in AccessMask: {1131f70a-e0f9-4f2b-bc37-4d3b2b12e2f7} (DS-Replication-Get-Changes-All) and {19195a5b-6da0-11d0-afd3-00c04fd930c9}. When a non-DC account accesses these rights, it indicates DCSync via Mimikatz or Impacket secretsdump.
Alert: AccessMask contains replication GUIDs from non-DC accounts. This is the primary DCSync indicator on the DC. Requires SACL on domain NC head.
SubjectUserNameObjectNameObjectTypePropertiesAccessMask | Tactic | Technique |
|---|---|
| Credential Access | DCSync (T1003.006) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: DCSync — Replication Rights Access
status: stable
description: Non-DC account using replication rights — DCSync attack
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 4662
AccessMask|contains:
- '1131f70a-e0f9-4f2b-bc37-4d3b2b12e2f7'
- '19195a5b-6da0-11d0-afd3-00c04fd930c9'
filter_dc:
SubjectUserName|endswith: '$'
condition: selection and not filter_dc
falsepositives:
- Azure AD Connect directory sync
- Legitimate DC replication
level: critical
tags:
- attack.credential_access
- attack.t1003.006
SecurityEvent
| where EventID == 4662 // An operation was performed on an object
| project TimeGenerated, Computer, SubjectUserName, ObjectName, ObjectType, Properties, AccessMask
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4662
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# An operation was performed on an object — add EventData fields: SubjectUserName, ObjectName, ObjectType, Properties`
An operation was performed on an object. Operation on an Active Directory object. AccessMask and ObjectType are key. Requires SACL on AD objects.
Event 4662 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).
Event 4662 is associated with: DCSync (T1003.006).
Alert: AccessMask contains replication GUIDs from non-DC accounts. This is the primary DCSync indicator on the DC. Requires SACL on domain NC head.