What is DCSync Attack?
DCSync Attack is a credential-theft technique in which an attacker abuses Active Directory's domain replication protocol to request password hashes for any account, including domain administrators, without running code on a domain controller. It is used to harvest credentials silently and move toward full domain compromise.
What it is
Active Directory uses a replication protocol called Directory Replication Service (DRS) so that domain controllers can synchronize changes. Legitimate domain controllers call a specific RPC method, GetNCChanges, to pull updates including password hashes.
A DCSync attack abuses this protocol. An attacker who has gained an account with replication rights, such as a member of Domain Admins, Enterprise Admins, or any account granted the "Replicating Directory Changes All" permission, can impersonate a domain controller. They call GetNCChanges from a regular workstation and request the NTLM hash or Kerberos keys for any account in the directory, including the krbtgt account used to forge Golden Tickets.
No malware needs to run on the domain controller itself. The attack is carried out entirely over the network using standard Windows protocols, which makes it hard to detect with endpoint tools alone.
Why it matters
A successful DCSync attack gives an attacker the password hash of any account in the domain. With the krbtgt hash, they can forge Kerberos tickets and maintain persistent access even after passwords are reset. With a domain admin hash, they can pass-the-hash to authenticate anywhere in the environment. This makes DCSync a common late-stage technique in ransomware and espionage intrusions.
The attack is associated with tools like Mimikatz and Impacket's secretsdump.py, which are widely available and require minimal skill to run once replication rights are obtained.
How tools address it
Identity Threat Detection and Response (ITDR) platforms are the primary control for detecting DCSync. They monitor directory replication traffic and flag GetNCChanges calls that originate from machines that are not registered domain controllers. Some platforms also track which accounts hold replication permissions and alert when those permissions are granted unexpectedly.