Lesson 3.10: DCSync and changes to privileged groups
Domain controllers replicate the directory, including password hashes, using two special permissions. Anyone else holding those permissions can ask a DC to 'replicate' and receive every hash, including krbtgt's: that's DCSync, effectively the end of the domain. It's detected as replication requests (event 4662 with the replication GUIDs) from an account that isn't a DC, and it's usually followed by new admin accounts. In the lab you find a DCSync by a service account, prove it isn't a DC, find who granted it the right, spot the backdoor admin created minutes later, and contain it.
18 min
You will learn to
- Explain DCSync and the replication rights
- Detect replication requests in 4662 events
- Tell domain controllers from other accounts
- Find who holds replication rights
- Contain a domain compromise and plan krbtgt resets
Key terms
- Replication rights
- 'Replicating Directory Changes' and '… All' (GUIDs 1131f6aa… and 1131f6ad…) let an account pull directory data, including secrets, from a DC.
- DCSync
- Using replication rights from a non-DC to obtain password hashes.
- Event 4662
- An operation was performed on a directory object; with the replication GUIDs in Properties, it records replication requests.
- krbtgt
- The account whose key signs every Kerberos ticket; with its hash an attacker can forge any ticket (golden ticket).
- Events 4728 / 4732 / 4756
- A member was added to a global / local / universal security group.
← Protecting sessions and cookies · All lessons · Thresholds and baselines →