OS Credential Dumping: DCSync
- ID
- T1003.006
- Tactics
- TA0006 Credential Access
- Sub-technique of
- T1003 OS Credential Dumping
- Platforms
- Windows
- Data sources
- Active Directory Object Access, Active Directory Object Deletion, Network Traffic Content
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)[3] [4] [5] [6] to simulate the replication process from a remote domain controller using a technique called DCSync.
Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data[1] from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a Golden Ticket for use in Pass the Ticket[7] or change an account's password as noted in Account Manipulation.[8]
DCSync functionality has been included in the "lsadump" module in Mimikatz.[9] Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.[10]
Detection
- DET0594 Detection of Unauthorized DCSync Operations via Replication API Abuse
Data components: Active Directory Object Access, Active Directory Object Deletion, Network Traffic Content
Mitigations (3)
- M1015 Active Directory Configuration
Manage the access control list for "Replicating Directory Changes" and other permissions associated with domain controller replication.[1][2]
- M1026 Privileged Account Management
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
- M1027 Password Policies
Ensure that local administrator accounts have complex, unique passwords across all systems on the network.