Hunting Active Directory Attacks

When to Use

• You have AD/domain-controller telemetry (Event IDs 4662, 4769, 4624) and want to detect DCSync replication abuse, Golden/Silver Ticket usage, and DCShadow.
• You are investigating credential-access and domain-persistence activity.

Do not use this for Kerberoasting/AS-REP roasting — those have a dedicated hunt. This focuses on replication abuse and forged-ticket anomalies.

Prerequisites

• Event ID 4662 (directory service access), 4769 (TGS requests), and 4624 (logons) with account and detail fields.

Workflow

Step 1: Hunt DCSync replication abuse

python scripts/analyst.py hunt events.csv

Flags 4662 events granting the replication rights GUIDs (DS-Replication-Get-Changes 1131f6aa-… / -All 1131f6ad-…) to non-DC accounts.

Step 2: Detect forged-ticket anomalies

Surface 4769 requests with anomalies consistent with Golden/Silver Tickets (RC4 where AES is expected, missing preceding 4768, or accounts that do not exist), and logons with mismatched ticket lifetimes.

Step 3: Confirm

Correlate the flagged account/host with whether it is a legitimate DC or replication service.

Step 4: Operationalize

Write a detection for replication-rights grants to non-DC principals.

Validation

• DCSync flags key on the replication GUIDs granted to non-DC accounts.
• Forged-ticket anomalies are based on encryption type / missing-AS-REQ evidence.
• Findings map to ATT&CK T1003.006 / T1558.001.

Pitfalls

• Legitimate DCs and Azure AD Connect perform replication — allow-list them.
• Golden Tickets can perfectly mimic valid TGS; rely on corroborating anomalies, not one signal.
• Incomplete auditing (4662 object-access auditing must be enabled) causing blind spots.

References

• See references/api-reference.md for the hunter.
• ATT&CK T1003.006 and Event 4662 (linked in frontmatter).