SkillsAdd

mukul975/anthropic-cybersecurity-skills

hunting-for-dcsync-attacks

Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts.

First seen Mar 17, 2026

Installation

$ npx skills add mukul975/anthropic-cybersecurity-skills --skill hunting-for-dcsync-attacks
View on skills.sh ↗ GitHub repository ↗

Summary

  • Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts.
  • Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

threat-hunting Similar name
zhaoxuya520/reverse-skill

Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and…

12 installs
dt-sec-ioc-hunting Similar name
dynatrace/dynatrace-for-ai

>- Hunt threat-intelligence indicators of compromise (IoCs) across Dynatrace logs and spans and…

24 installs
threat-hunting Similar name
briiirussell/cybersecurity-skills

Conduct proactive, hypothesis-driven threat hunts — search SIEM / EDR / logs for adversaries wh…

221 installs
Threat Hunting & IOC Analysis Similar name
masriyan/claude-code-cybersecurity-skill

IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generati…

179 installs

Also in this package

Other skills from mukul975/anthropic-cybersecurity-skills · top by installs.

npx skills add mukul975/anthropic-cybersecurity-skills
analyzing-api-gateway-access-logs 726 acquiring-disk-image-with-dd-and-dcfldd 653 analyzing-android-malware-with-apktool 620 testing-api-security-with-owasp-top-10 591 analyzing-cyber-kill-chain 586 Create Fake Materials: Fake Website 575 analyzing-browser-forensics-with-hindsight 574 conducting-api-security-testing 565 analyzing-docker-container-forensics 553 analyzing-cloud-storage-access-patterns 540

Browse all from mukul975/anthropic-cybersecurity-skills

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 32.4K
License LICENSE
Default branch main
Open issues 20
Status Active

Skill metadata

Parsed from SKILL.md frontmatter.

Version1.0
LicenseApache-2.0

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 3,586 B
  • docs SUMMARY.md 437 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 61 installs

SKILL.md

Hunting for DCSync Attacks

When to Use

  • When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)
  • After detecting Mimikatz or similar tools in the environment
  • During incident response involving Active Directory compromise
  • When monitoring for unauthorized domain replication requests
  • During purple team exercises testing AD attack detection

Prerequisites

  • Windows Security Event Log forwarding enabled (Event ID 4662)
  • Audit Directory Service Access enabled via Group Policy
  • Domain Computers SACL configured on Domain Object for machine account detection
  • SIEM with Windows event data ingested (Splunk, Elastic, Sentinel)
  • Knowledge of legitimate domain controller accounts and replication partners

Workflow

  1. Enable Auditing: Ensure Audit Directory Service Access is enabled on domain controllers.
  2. Collect Events: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access).
  3. Filter Replication GUIDs: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
  4. Identify Non-DC Sources: Flag events where SubjectUserName is not a domain controller machine account.
  5. Correlate with Network: Cross-reference source IPs against known DC addresses.
  6. Validate Findings: Exclude legitimate replication tools (Azure AD Connect, SCCM).
  7. Respond: Disable compromised accounts, reset krbtgt, investigate lateral movement.

Key Concepts

Concept Description
DCSync Technique abusing AD replication protocol to extract password hashes
Event ID 4662 Directory Service Access audit event
DS-Replication-Get-Changes GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
DS-Replication-Get-Changes-All GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
AccessMask 0x100 Control Access right indicating extended rights verification
T1003.006 OS Credential Dumping: DCSync

Tools & Systems

Tool Purpose
Windows Event Viewer Direct event log analysis
Splunk SIEM correlation of Event 4662
Elastic Security Detection rules for DCSync patterns
Mimikatz lsadump::dcsync Attack tool used to perform DCSync
Impacket secretsdump.py Python-based DCSync implementation
BloodHound Identify accounts with replication rights

Output Format

Hunt ID: TH-DCSYNC-[DATE]-[SEQ]
Technique: T1003.006
Domain Controller: [DC hostname]
Subject Account: [Account performing replication]
Source IP: [Non-DC IP address]
GUID Accessed: [Replication GUID]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Disable account, reset krbtgt, investigate]