Directory replication rights exercised by a non-machine account

1title: Directory replication rights exercised by a non-machine account2id: 3e1db1cb-d351-420a-96cc-3d6d1259a31f3status: experimental4description: |5  Implements AN1632 on Security EventID 4662: a directory object access in which6  the control access right exercised is one of the three replication extended7  rights, requested by a principal whose name does not end in a dollar sign.8  That pairing is the whole detection. DCSync works by asking a domain9  controller to replicate secrets through DRSUAPI, and a genuine replication10  partner is a domain controller presenting its own computer account, so the11  account-name shape is what separates the tool from the protocol. The three12  GUIDs are DS-Replication-Get-Changes, DS-Replication-Get-Changes-All and13  DS-Replication-Get-Changes-In-Filtered-Set; matching any one of them rather14  than requiring the pair a full secret pull needs keeps the rule on15  reconnaissance-shaped calls too. Two field-format cautions matter more than16  the logic. `AccessMask` is written by Windows as the hex string 0x100 for a17  control access right, so a pipeline that zero-pads it, lower-cases the prefix18  or converts it to decimal turns this selection permanently false; and19  `Properties` is a multi-value blob, which is why it is matched with contains20  rather than by equality. Several limits belong on the face of the rule.21  MITRE's `SourceIP` knob cannot be applied here at all — 4662 carries no22  client address field, so "expected replication should only come from known23  DCs" is not expressible on this event, and neither is the `TimeWindow`24  correlation the analytic describes, lib/sigma having no timeframe or join.25  The machine-account filter is also the rule's blind spot: DCSync run under a26  stolen computer account, or from a compromised domain controller's own27  identity, is filtered out by design. EventID 4929 from the brief is not used —28  it records the removal of a replica source naming context, an administrative29  topology change rather than a secret pull. Prerequisite: 4662 needs *Audit30  Directory Service Access* enabled for Success on domain controllers and an31  audit ACE on the domain naming context covering the replication extended32  rights. DS Access auditing is in the domain controller baseline, but the SACL33  is worth confirming on the domain object before trusting a quiet result,34  because if either half is missing the rule returns zero rows and zero rows35  reads as quiet when it means blind.36  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0594, not hand-written and not tested by its author. Any lab result is on this rule's own page.37references:38  - https://attack.mitre.org/techniques/T1003/00639  - https://attack.mitre.org/detectionstrategies/DET059440author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)41date: 2026-08-1642tags:43  - attack.credential-access44  - attack.t1003.00645logsource:46  product: windows47  service: security48detection:49  selection:50    EventID: 466251    AccessMask: '0x100'52    Properties|contains:53      - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'54      - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'55      - '89e95b76-444d-4c62-991a-0facbeda640c'56  filter_machine_account:57    SubjectUserName|endswith: '$'58  condition: selection and not filter_machine_account59falsepositives:60  - "The directory synchronisation account of Microsoft Entra Connect. With password hash sync enabled it holds Replicate Directory Changes and Replicate Directory Changes All and exercises them continuously — every two minutes on the default schedule — under a user account such as MSOL_<hex> that does not end in a dollar sign and so survives the filter. On any tenant using password hash sync this is the highest-volume match by a wide margin. It is one enumerable, statically named principal rather than a class of users, which is why the level is medium rather than low, and excluding it by name is what MITRE's UserContext knob is for."61  - "Password-auditing and directory-assessment tooling run by the identity team. DSInternals Get-ADReplAccount, Specops Password Auditor, Semperis Purple Knight and equivalent products pull hashes through the same replication API on purpose, typically on a weekly or monthly schedule from an administrator workstation, and the event is byte-for-byte what an attack produces."62  - "Directory migration and coexistence products during a cutover. Quest Migration Manager, BinaryTree and similar tools are granted replication rights so they can move password data between forests, and they exercise them in sustained bursts for the duration of a migration window."63  - "Third-party identity and security platforms that ingest directory data — some privileged access management, password-breach detection and identity-threat products request replication rights at deployment, so the first match after a new tool is installed is a change-management question rather than an incident."64level: medium