Sigma medium test sigma

Suspicious Machine Account Replication - DcSync Indicator

Detects suspicious Active Directory Replication Service (ADRS) requests originating from a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller. Under normal operation, only Domain Controllers initiate replication requests carrying the DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account credentials — for example by abusing certificate-based authentication (PKINIT) to impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost), where a temporary machine account is created to request a DC certificate and then used to perform DCSync — they can dump all domain credential material including the krbtgt hash.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4662,
    "Properties
| contains": [
      "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2",
      "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",
      "9923a32a-3607-11d2-b9be-0000f87a36b2",
      "89e95b76-444d-4c62-991a-0facbeda640c"
    ],
    "SubjectUserName
| endswith": "$"
  },
  "filter_main_subject_usersid": {
    "SubjectUserSid
| startswith": "S-1-5-18"
  },
  "condition": "selection and not 1 of filter_main_*"
}

False Positives

  • ⚠ Valid DC Sync that is not covered by the filters; please report

Field Validations

Loading…

Comments (0)

Loading comments...