Password hash accessed via Directory Replication Service. Generated during DCSync operations.
Generated during DCSync (Mimikatz lsadump::dcsync, Impacket secretsdump.py). An attacker with DS-Replication-Get-Changes-All right pulls all password hashes without touching LSASS. Non-DC computers generating this is a critical indicator.
Alert: SubjectUserName is not a DC computer account. Alert: rapid succession of 4782 events (pulling multiple hashes = full domain dump). Extremely low false-positive rate outside legitimate DC replication.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Credential Access | OS Credential Dumping: DCSync (T1003.006) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Password Hash Access — Possible DCSync
status: experimental
description: Password hash access indicating possible DCSync attack
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 4782
filter_dc:
SubjectUserName|endswith: '$'
condition: selection and not filter_dc
falsepositives:
- Legitimate DC-to-DC replication
- Azure AD Connect sync
level: critical
tags:
- attack.credential_access
- attack.t1003.006
SecurityEvent
| where EventID == 4782 // The password hash an account was accessed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4782
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The password hash an account was accessed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
The password hash an account was accessed. Password hash accessed via Directory Replication Service. Generated during DCSync operations.
Event 4782 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4782 is associated with: OS Credential Dumping: DCSync (T1003.006).
Alert: SubjectUserName is not a DC computer account. Alert: rapid succession of 4782 events (pulling multiple hashes = full domain dump). Extremely low false-positive rate outside legitimate DC replication.