Excessive DRSGetNCChanges Requests [splunk-winevent]

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync. During a FIN8 attack, a desktop device performed more than 100 DRSGetNCChanges requests to a domain controller. Such activity, when not performed by new domain controllers to sync Active Directory contents, can indicate malicious domain or user enumeration, credential compromise or Active Directory enumeration. This use case detects excessive DRSGetNChanges requests (represented by GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2). Note: Windows Event ID 4662 must be logged and configured correctly for detection. Blocklisting event 4662 event collection and forwarding from expected hosts (likely other Domain Controllers) is recommended for best performance, as activity from DCs is expected behavior. See references for details. -- Threat Actor Association: FIN8 (Syssphinx), Muddled Libra, Scattered Spider