Analytics BIOC Low
✕

Possible DCSync from a non domain controller

Attackers may pose a compromised host as a DC to replicate data to it (DCSync).

Module:
Platform Analytics
Data source:
Palo Alto Networks Firewall traffic Logs, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Credential Access (TA0006) Defense Evasion (TA0005)
ATT&CK techniques: OS Credential Dumping: DCSync (T1003.006) Rogue Domain Controller (T1207)
Detector tags: Impacket Analytics
Attacker's goals:

An attacker is trying to retrieve Active Directory data, including password hashes.

Investigative actions:

Check whether one of the machines is a new domain controller.

Test period:
N/A (single event)
Deduplication:
1 Day
5 variations:
  • DCSync from a non domain controller from a non-standard process High (parent: Low)
  • Large DCSync from a non domain controller by AppID Medium (parent: Low)
  • Large DCSync from a non domain controller Medium (parent: Low)
  • Possible DCSync from an internet-facing server Medium (parent: Low)
  • DCSync from a non domain controller Low