Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Hunting for DCSync Attacks · mukul975 | DecimalAI

Hunting For Dcsync Attacks

SkillScore18Maintained

hunting-for-dcsync-attacks

Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/hunting-for-dcsync-attacks/SKILL.md

decimalai skills pull hunting-for-dcsync-attacks --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/hunting-for-dcsync-attacks/SKILL.md https://app.decimal.ai/s/hunting-for-dcsync-attacks/SKILL.md

Raw file: /s/hunting-for-dcsync-attacks/SKILL.md ↗ · machine-readable summary at /s/hunting-for-dcsync-attacks.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +14% lift+21% tokens0% turns18% of whole cases pass with skill (4/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-10	✗→✓	▲ Improved	—	—
case-09	✗→✓	▲ Improved	—	—
case-14	✗→✓	▲ Improved	—	—
case-01	✓→✓	＝ Same ✓	—	—
case-06	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/hunting-for-dcsync-attacks/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Hunting for DCSync Attacks

When to Use

When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)
After detecting Mimikatz or similar tools in the environment
During incident response involving Active Directory compromise
When monitoring for unauthorized domain replication requests
During purple team exercises testing AD attack detection

Prerequisites

Windows Security Event Log forwarding enabled (Event ID 4662)
Audit Directory Service Access enabled via Group Policy
Domain Computers SACL configured on Domain Object for machine account detection
SIEM with Windows event data ingested (Splunk, Elastic, Sentinel)
Knowledge of legitimate domain controller accounts and replication partners

Workflow

Enable Auditing: Ensure Audit Directory Service Access is enabled on domain controllers.
Collect Events: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access).
Filter Replication GUIDs: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
Identify Non-DC Sources: Flag events where SubjectUserName is not a domain controller machine account.
Correlate with Network: Cross-reference source IPs against known DC addresses.
Validate Findings: Exclude legitimate replication tools (Azure AD Connect, SCCM).
Respond: Disable compromised accounts, reset krbtgt, investigate lateral movement.

Key Concepts

| Concept | Description | |---------|-------------| | DCSync | Technique abusing AD replication protocol to extract password hashes | | Event ID 4662 | Directory Service Access audit event | | DS-Replication-Get-Changes | GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 | | DS-Replication-Get-Changes-All | GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 | | AccessMask 0x100 | Control Access right indicating extended rights verification | | T1003.006 | OS Credential Dumping: DCSync |

Tools & Systems

| Tool | Purpose | |------|---------| | Windows Event Viewer | Direct event log analysis | | Splunk | SIEM correlation of Event 4662 | | Elastic Security | Detection rules for DCSync patterns | | Mimikatz lsadump::dcsync | Attack tool used to perform DCSync | | Impacket secretsdump.py | Python-based DCSync implementation | | BloodHound | Identify accounts with replication rights |

Output Format

Hunt ID: TH-DCSYNC-[DATE]-[SEQ]
Technique: T1003.006
Domain Controller: [DC hostname]
Subject Account: [Account performing replication]
Source IP: [Non-DC IP address]
GUID Accessed: [Replication GUID]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Disable account, reset krbtgt, investigate]

Illustrative Want to see what hunting-for-dcsync-attacks would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 03:13 UTC · 22 cases

Lift

+14%

18% vs 5%

Agent turns

0%

1.0 vs 1.0

Tokens

+21%

2,121.64 vs 1,754.36

fail → pass · 3pass → pass · 1fail → fail · 18

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-06 An alert indicates a potential AD CS (Active Directory Certificate Services) ESC1 abuse attempt where a user requested a certificate with SAN impersonation. What specific event IDs and certificate template parameters should be audited?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 To ensure complete coverage against full domain credential extraction, which specific GUID corresponding to DS-Replication-Get-Changes-All must be included alongside DS-Replication-Get-Changes in the event filter?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 When writing a SIEM query for DCSync detection, an engineer wants to monitor the specific Active Directory extended right GUID for DS-Replication-Get-Changes. What exact GUID string represents this right?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 A threat hunter is writing a Python script to test replication vulnerability on a non-domain machine. Which popular Python-based offensive security tool framework includes the secretsdump.py module used to execute DCSync?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 An auditor asks which Windows Group Policy setting must be enabled on domain controllers to ensure Event ID 4662 is generated for object access.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 Our SIEM generated multiple alerts for Event ID 4769 with encryption type 0x17 targeting service accounts. Analyze this activity for potential Kerberoasting attacks in Active Directory and recommend detection query filters.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 When searching Windows Security Event Logs to detect Active Directory replication rights abuse, a junior analyst suggests searching for generic logon Event ID 4624. Which specific Security Event ID must be monitored to capture directory service access attempts?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 When conducting Active Directory incident response after confirming a DCSync compromise, resetting normal user passwords is insufficient to revoke persistent ticket forge capabilities. What specific system account key must be reset twice to invalidate ticket granting tokens?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 During a SIEM investigation of Event ID 4662, an analyst notices regular replication activity from an account named AADC_ServiceAccount. Should this account be flagged immediately as compromised, or checked against legitimate synchronization tool exclusions?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 After detecting unauthorized replication activity from workstation IP 10.0.4.15 using account CORP\jdoe, what immediate account action should be included in the incident response recommendations?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Our SOC flagged potential password hash extraction using domain replication from a non-DC host. Walk through the verification workflow for this event and provide a hunt summary that includes the Hunt ID, technique identifier, domain controller involved, subject account name, source IP, replication GUID, calculated risk level, and remediation recommendations.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We suspect a DCSync attack was performed against our Active Directory domain after detecting suspicious activity on a workstation. Please analyze our event logs for unauthorized directory replication requests and produce a formal threat hunt report including the Hunt ID, MITRE technique, target domain controller, subject account, source IP address, accessed GUID, risk level, and recommended action.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 We need to query Active Directory domain permissions to audit which accounts currently possess replication extended rights before an attack occurs. Which graph-based Active Directory security audit tool is standard for mapping these permission paths?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We suspect an adversary generated a forged Kerberos Ticket-Granting Ticket (Golden Ticket) using a stolen domain hash. Describe how to hunt for Golden Ticket usage in Windows Event Logs.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 In Windows Event ID 4662 logs, many object access events record standard object read operations. Which specific AccessMask hexadecimal value distinguishes Control Access / Extended Rights extended verification from ordinary object reads?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 An analyst claims that filtering Event ID 4662 logs for GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 and 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 is sufficient to detect all DCSync attempts targeting Read-Only Domain Controller (RODC) filtered attribute sets. Which third extended right GUID specifically covers DS-Replication-Get-Changes-In-Filtered-Set?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We need to hunt for credential dumping activity following an alert indicating Mimikatz execution on account HR-FINANCE01. Examine the Directory Service Access logs and generate a structured hunt result containing Hunt ID, technique code, target DC, subject user, source IP, GUID, risk level, and next steps.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 During post-incident containment following a confirmed DCSync attack, what additional investigation step should be taken alongside account disabling and krbtgt reset?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 In an Event ID 4662 log, how should the analyst evaluate the SubjectUserName field to isolate malicious DCSync activity from legitimate domain controller replication?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 To detect machine accounts attempting unauthorized AD directory replication, what specific SACL configuration must be applied to the domain object?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 What is the official MITRE ATT&CK sub-technique ID assigned to DCSync credential extraction under OS Credential Dumping?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 While reviewing Event ID 4662 logs, an analyst sees replication requests originating from a System Center Configuration Manager service account. What operational step should be taken regarding SCCM?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +14 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 18.2%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 1
Skill version measured: v1
Run completed: 7/28/2026, 03:13 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run18

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+25% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.