Detection rule
DCSync detection (T1003.006)
Directory replication by an account that isn't a domain controller. GraphnAI raises an alert when it sees this in your domain controllers' security events.
How GraphnAI finds it
An OpenTelemetry collector sends the Windows Security log from your domain controllers to your GraphnAI server. GraphnAI checks each batch of events against every active rule.
This rule reads one event:
- 4662An operation was performed on an object
The first matching event raises the alert. While its evidence is inside the 1-minute window, the rule doesn't raise the same alert again.
The alert shows the account's type and tier, and how many of its paths to Tier 0 are Validated.
Tiered Fidelity™ level: Validated
Telemetry saw the activity itself, so GraphnAI marks the account that acted with an alert edge at the Validated level.
- TheoreticalConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedThis alertTelemetry has seen it in use.
How you respond with Select Fire™
From the alert, Select Fire opens on the account that acted. You simulate a change there before you authorize it.
- Full-AutoAutomatic containment needs a detection verified for it, and this one hasn’t been verified yet, so a person decides.
- A person decidesQuarantine the accountOn the account that acted.
Close the exposure first
These posture checks find the conditions this attack depends on, before anyone uses them.
MITRE ATT&CK® technique names: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation.
See what's hitting your identities.
The Public Preview is free for 30 days from your first sync, on your own server.