Home/ MITRE Matrix/ Credential Access/ T1003.006

T1003.006DCSync

T1003.006 — DCSync is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 4 detection use cases covering it and 1 threat-intel article citing it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

4Use cases

1Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1003 · OS Credential Dumping

Use cases covering this technique (4)

Windows AD Replication Request Initiated by User Account ESCU actions · alerting P Windows AD Replication Request Initiated from Unsanctioned Location ESCU actions · alerting P Windows AD Replication Service Traffic ESCU actions · alerting P [LLM] Directory replication / DCSync of secrets (krbtgt) via impersonated DC identity Bespoke actions · hunting DSΣPDD

Articles citing this technique (1)

crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-97