Last reviewed:
T1003.006 is DCSync: invoking Directory Replication Service interfaces to retrieve account secrets as though the caller were a Domain Controller. The critical evidence is not the DC account name alone but where replication originated. CertiGhost can place a validly authenticated DC identity on an attacker-controlled host, defeating rules that discard every subject ending in a dollar sign. DCV has no cloud-native equivalent for the replication call; defenders must join Events 4662 and 4624 to source-address context before tracing stolen credentials into connected cloud control planes.
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.
Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a Golden Ticket for use in Pass the Ticket or change an account's password as noted in Account Manipulation.
DCSync functionality has been included in the "lsadump" module in Mimikatz. Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.
Platforms: Windows.
DCV does not currently ship a cloud-audit-log finding mapped directly to T1003.006. The technique earns a library page because a13e research cites it. Detection sits downstream, on the exploitation step the technique enables.
CloudSigma does not currently ship a stand-alone rule that fires on T1003.006 in isolation. Generate a starting-point rule from the CVE, vulnerability disclosure, or threat-research blog post that exercises this technique, then pair it with SIEM-side correlation before enabling in production.
High-fidelity detection of T1003.006 requires correlation
across multiple events. For example, a credential-validation call
followed by a reconnaissance chain (List* /
Describe*) within a short window from an unfamiliar
source. A single-event Sigma rule on
GetCallerIdentity alone fires constantly on
legitimate CLI, SDK and CI/CD activity.
Where you have a specific advisory, vulnerability disclosure or blog post that exercises T1003.006-style abuse, CloudSigma can generate a starting-point rule from that input. You then deploy it in your SIEM and combine it with the SIEM's native correlation features (timeframe joins across users, source-IP anomalies, impossible-travel checks). For T1003.006 specifically the generated rule is rarely sufficient on its own; pair it with the SIEM-side correlation logic before enabling in production.
T1003.006 is DCSync: invoking Directory Replication Service interfaces to retrieve account secrets as though the caller were a Domain Controller. The critical evidence is not the DC account name alone but where replication originated. CertiGhost can place a validly authenticated DC identity on an attacker-controlled host, defeating rules that discard every subject ending in a dollar sign. DCV has no cloud-native equivalent for the replication call; defenders must join Events 4662 and 4624 to source-address context before tracing stolen credentials into connected cloud control planes.
T1003.006 has no cloud-audit-log signal of its own; DCV does not currently ship a finding mapped directly to it. The technique earns a library page because a13e research cites it. Detection sits downstream, on the exploitation step the technique enables (see Related techniques).
T1003.006 is part of MITRE ATT&CK TA0006 Credential Access: How adversaries steal credentials, account names and passwords.
T1003.006 requires multi-event correlation that exceeds a single Sigma rule's structure. CloudSigma can generate a starting-point rule from a CVE, vulnerability disclosure, or threat-research blog post that exercises T1003.006-style abuse; pair it with SIEM-side correlation logic before enabling in production.