| elastic |
Potential Credential Access via DCSync |
production |
2026-10-06 |
| elastic |
Potential Active Directory Replication Account Backdoor |
production |
2026-09-18 |
| elastic |
First Time Seen Account Performing DCSync |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Potential Invoke-Mimikatz PowerShell Script |
production |
2026-09-18 |
| sigma |
Suspicious Machine Account Replication - DcSync Indicator |
test |
2026-07-30 |
| sigma |
Active Directory Replication from Non Machine Account - DcSync Indicator |
test |
2026-07-30 |
| splunk |
Windows AD Replication Request Initiated by User Account |
production |
2026-05-13 |
| splunk |
Windows AD Replication Request Initiated from Unsanctioned Location |
production |
2026-05-13 |
| splunk |
Windows AD Replication Service Traffic |
experimental |
2026-05-13 |
| sigma |
HackTool - Mimikatz Execution |
test |
2023-02-21 |
| sigma |
Credential Dumping Tools Service Execution - Security |
test |
2022-11-29 |
| sigma |
Credential Dumping Tools Service Execution - System |
test |
2022-11-29 |
| sigma |
Suspicious Get-ADReplAccount |
test |
2022-02-06 |
| sigma |
Mimikatz Use |
test |
2022-01-05 |