AD object attributes replicated between DCs.
High volume of specific attribute replications from non-DC accounts may indicate DCSync. Correlate with 4662 for replication rights usage.
No standalone alerting. Use to corroborate DCSync investigation.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4934 // Attributes of an Active Directory object were replicated
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4934
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Attributes of an Active Directory object were replicated — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`Attributes of an Active Directory object were replicated. AD object attributes replicated between DCs.
Event 4934 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).
No standalone alerting. Use to corroborate DCSync investigation.