To execute a DCSync attack, a hacker must possess either the “Replicating Directory Changes” or “Replicating Directory Changes All” permissions. It’s crucial to note that attackers often gain these permissions after compromising a less privileged account through other means like phishing attacks, password spraying, zero-day attacks, exploiting software vulnerabilities, etc.