SigmaHQ/rules/windows/builtin/win_dcsync.yml

title: Mimikatz DC Sync
id: 611eab06-a145-4dfa-a295-3ccc5c20f59a
description: Detects Mimikatz DC sync security events
status: experimental
date: 2018/06/03
modified: 2020/09/11
author: Benjamin Delpy, Florian Roth, Scott Dermott
references:
    - https://twitter.com/gentilkiwi/status/1003236624925413376
    - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
tags:
    - attack.credential_access
    - attack.s0002
    - attack.t1003          # an old one
    - attack.t1003.006
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4662
        Properties|contains:
            - 'Replicating Directory Changes All'
            - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'
    filter1:
        SubjectDomainName: 'Window Manager'
    filter2:
        SubjectUserName|startswith:
            - 'NT AUTHORITY'
            - 'MSOL_'
    filter3:
        SubjectUserName|endswith:
            - '$'
    condition: selection and not filter1 and not filter2 and not filter3
falsepositives:
    - Valid DC Sync that is not covered by the filters; please report
level: high
Rule: DCSync 2018-06-03 14:00:57 +00:00			`title: Mimikatz DC Sync`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: 611eab06-a145-4dfa-a295-3ccc5c20f59a`
Rule: DCSync 2018-06-03 14:00:57 +00:00			`description: Detects Mimikatz DC sync security events`
			`status: experimental`
			`date: 2018/06/03`
+ Adding exclusion for Azure AD Sync (MSOL_xxxxxxxx) AD Connect on premise AD accounts to Azure AD. The replication process is completed under the context of the 'MSOL_xxxxxxxx' user account. The AD Connect application is installed on a member server (i.e. not on a DC). https://techcommunity.microsoft.com/t5/azure-advanced-threat-protection/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028 2020-09-11 15:06:51 +00:00			`modified: 2020/09/11`
			`author: Benjamin Delpy, Florian Roth, Scott Dermott`
Rule: DCSync 2018-06-03 14:00:57 +00:00			`references:`
			`- https://twitter.com/gentilkiwi/status/1003236624925413376`
			`- https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2`
Add tags to windows builtin rules 2018-07-24 05:50:32 +00:00			`tags:`
			`- attack.credential_access`
ATT&CK tagging QA 2018-09-20 10:44:44 +00:00			`- attack.s0002`
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-24 23:09:17 +00:00			`- attack.t1003 # an old one`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- attack.t1003.006`
Rule: DCSync 2018-06-03 14:00:57 +00:00			`logsource:`
			`product: windows`
			`service: security`
			`detection:`
			`selection:`
			`EventID: 4662`
Update win_dcsync.yml 2020-10-15 18:19:18 +00:00			`Properties\|contains:`
			`- 'Replicating Directory Changes All'`
			`- '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'`
fix: FPs with Mimikatz DC Sync rule 2019-10-08 15:43:50 +00:00			`filter1:`
			`SubjectDomainName: 'Window Manager'`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`filter2:`
Update win_dcsync.yml 2020-10-15 18:19:18 +00:00			`SubjectUserName\|startswith:`
			`- 'NT AUTHORITY'`
			`- 'MSOL_'`
Update win_dcsync.yml 2020-10-15 23:19:06 +00:00			`filter3:`
Update win_dcsync.yml 2020-10-15 18:19:18 +00:00			`SubjectUserName\|endswith:`
			`- '$'`
Fix filter 2020-10-16 10:35:59 +00:00			`condition: selection and not filter1 and not filter2 and not filter3`
Rule: DCSync 2018-06-03 14:00:57 +00:00			`falsepositives:`
fix: Mimikatz DC Sync rule FP description and level 2019-10-08 15:45:10 +00:00			`- Valid DC Sync that is not covered by the filters; please report`
			`level: high`
Rule: DCSync 2018-06-03 14:00:57 +00:00