Active Directory Replication from Non Machine Account - DcSync Indicator

{
  "selection": {
    "EventID": 4662,
    "Properties
| contains": [
      "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2",
      "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",
      "9923a32a-3607-11d2-b9be-0000f87a36b2",
      "89e95b76-444d-4c62-991a-0facbeda640c"
    ]
  },
  "filter_main_machine_accounts": {
    "SubjectUserName
| endswith": "$"
  },
  "filter_optional_subject_domain": {
    "SubjectDomainName": "Window Manager"
  },
  "filter_optional_subject_usersid": {
    "SubjectUserName
| startswith": [
      "NT AUT",
      "MSOL_"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

False Positives

• ⚠ Unknown