Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)1234 to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data5 from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a Golden Ticket for use in Pass the Ticket6 or change an account's password as noted in Account Manipulation.7 DCSync functionality has been included in the "lsadump" module in Mimikatz.8 Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.9
- Microsoft DRSR Dec 2017
- Microsoft GetNCCChanges
- Samba DRSUAPI
- Wine API samlib.dll
- ADSecurity Mimikatz DCSync
- Harmj0y Mimikatz and DCSync
- InsiderThreat ChangeNTLM July 2017
- GitHub Mimikatz lsadump Module
- Microsoft NRPC Dec 2017
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0129 | Mustang Panda | China |
| grp_g1053 | Storm-0501 | — |
| grp_g1004 | LAPSUS$ | — |
| grp_g1059 | NIMBUS MANTICORE | — |
| grp_g1006 | Earth Lusca | China |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.