Query: Sigma rule for Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials
Matching passage: Sigma rule: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials. Logsource: windows / security. Rule: title: Active Directory Replication from Non Machine Account - DcSync Indicator id: 17d619c1-e020-4347-957e-1d1207455c93 related: - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a type: similar status: test description: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials. references: - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html - https://threathunterplaybook.com/library/windows/active_directory_replication.html - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-07-26 modified: 2026-07-30 tags: - attack.credential-access - attack.t1003.006 logsource: product: windows service: security definition: 'Requirements: A SACL must be configured on the domain NC root object (e.g. DC=domain,DC=com) to generate Event 4662. Add via ADSI Edit: navigate to the domain NC root → Properties → Security → Advanced → Auditing → add an ACE for Everyone, Type: Success, Applies to: This object only, rights: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. The OS audit subcategory must also be enabled: auditpol /set /subcategory:"Directory Service Access" /success:enable ' detection: selection: EventID: 4662 Properties|contains: - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 - 9923a32a-3607-11d2-b9be-0000f87a36b2 - 89e95b76-444d-4c62-991a-0facbeda640c filter_main_machine_accounts: SubjectUserName|endswith: $ filter_optional_subject_domain: SubjectDomainName: Window Manager filter_optional_subject_usersid: SubjectUserName|startswith: - NT AUT - MSOL_ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the f. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation id: 4bf943c6-5146-4273-98dd-e958fd1e3abf status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2026-03-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: - CommandLine|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - CommandLine|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - CommandLine|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - CommandLine|re: \$env:ComSpec\[(?:\s*\d{1,3}\s*,){2} - CommandLine|re: \*mdr\*\W\s*\)\.Name - CommandLine|re: \$VerbosePreference\.ToString\( - CommandLine|re: \[String\]\s*\$VerbosePreference condition: selection falsepositives: - Unknown level: high