Meta tags:

Headings (most frequently used words):

os, credential, dumping, dcsync, procedure, examples, mitigations, detection, strategy, references, other, sub, techniques, of,

Text of the page (most frequently used words):
the (26), retrieved (23), and (19), #dcsync (18), all (12), december (12), 2017 (12), mimikatz (11), t1003 (11), att (10), enterprise (10), from (10), for (9), domain (9), microsoft (8), directory (8), account (8), replication (8), credentials (8), 2022 (7), data (6), techniques (6), october (6), september (6), with (6), credential (6), 2015 (5), ics (5), mobile (5), none (5), groups (5), detection (5), cyber (5), security (5), accounts (5), password (5), controller (5), has (5), used (5), dumping (5), mitre (4), are (4), sub (4), service (4), threat (4), 2025 (4), january (4), defender (4), 2021 (4), 2020 (4), centre (4), systems (4), access (4), version (4), use (3), resources (3), cti (3), mitigations (3), defenses (3), tactics (3), august (3), storm (3), 0501 (3), 365 (3), using (3), operation (3), wocao (3), mustang (3), panda (3), national (3), tools (3), active (3), may (3), earth (3), lusca (3), operations (3), remote (3), protocol (3), lsadump (3), user (3), api (3), description (3), name (3), local (3), administrator (3), across (3), network (3), privileged (3), other (3), during (3), information (3), c0027 (3), technique (3), 006 (3), 2026 (2), corporation (2), domains (2), reference (2), campaigns (2), software (2), components (2), analytics (2), strategies (2), assets (2), matrices (2), core (2), objects (2), replicating (2), changes (2), crowdstrike (2), campaign (2), february (2), mstic (2), team (2), deep (2), solorigate (2), against (2), 2019 (2), hacking (2), 2023 (2), attacks (2), november (2), new (2), zealand (2), ncsc (2), march (2), deply (2), targeting (2), july (2), not (2), june (2), toux (2), module (2), passwords (2), 2024 (2), drs (2), unauthorized (2), via (2), often (2), actors (2), analytic (2), admin (2), solarwinds (2), compromise (2), memory (2), obtain (2), performs (2), useful (2), functionality (2), about (2), netsync (2), lapsus (2), windows (2), which (2), administrators (2), hashes (2), can (2), ticket (2), etc (2), ckcon (2), person (2), tickets (2), faq (2), registered, trademarks, cookie, preferences, website, changelog, privacy, policy, terms, contact, reset, filters, how, grant, permission, metadirectory, services, adma, intelligence, evolving, lead, cloud, based, ransomware, early, bird, catches, wormhole, observations, stellarparticle, cdoc, research, dive, into, second, stage, activation, sunburst, teardrop, raindrop, protect, dantzig, schamper, shining, light, one, china, hidden, lior, rochberger, tom, fakterman, robert, falcone, cyberespionage, southeast, asian, government, linked, stately, taurus, aka, strategic, llc, cobalt, strike, advanced, penetration, testers, april, australian, acsc, canadian, cccs, cert, cybersecurity, communications, integration, center, nccic, 2018, joint, report, publicly, available, grafnetter, retrieving, dpapi, backup, keys, dart, m365, dev, 0537, criminal, actor, organizations, exfiltration, destruction, chen, delving, analysis, parisi, simulation, investigations, reveal, intrusion, telco, bpo, companies, nrpc, netlogon, 2016, warren, manipulating, schroeder, extrasids, metcalf, usage, exploitation, wine, samlib, dll, sambawiki, drsuapi, idl_drsgetncchanges, opnum, drsr, references, detects, invocation, executed, similar, non, endpoints, an1632, abuse, det0594, strategy, put, unless, they, tightly, controlled, this, equivalent, having, same, follow, best, practices, design, administration, limit, administrative, tiers, management, m1026, ensure, that, have, complex, unique, policies, m1027, manage, control, list, permissions, associated, configuration, m1015, mitigation, utilized, extract, victims, g1053, replicate, controllers, apt29, c0024, dump, targeted, system, c0014, leveraged, feature, g0129, gaining, additional, contains, acquire, many, ways, including, s0002, gather, privilege, escalation, routines, g1004, command, retrieve, exploited, g1006, performed, scattered, spider, procedure, examples, live, permalink, last, modified, created, extrahop, vincent, contributors, platforms, tactic, been, included, also, includes, over, legacy, members, admins, computer, able, run, pull, include, current, historical, potentially, such, krbtgt, then, turn, create, change, noted, manipulation, pass, golden, adversaries, attempt, sensitive, abusing, application, programming, interface, simulate, process, called, passwd, shadow, 008, proc, filesystem, 007, cached, 005, lsa, secrets, 004, ntds, 003, manager, 002, lsass, 001, home, open, join, mclean, hotel, location, details, found, register, here, search, blog, contribute, benefactors, legal, branding, updates, history, engage, advisory, council, learn, more, get, started, detections,

Text of the page (random words):
os credential dumping dcsync sub technique t1003 006 enterprise mitre att ck matrices enterprise mobile ics tactics enterprise mobile ics techniques enterprise mobile ics defenses mitigations enterprise mobile ics assets detections detection strategies analytics data components cti groups software campaigns resources get started learn more about att ck att ck advisory council att ckcon att ck data tools faq engage with att ck version history updates legal branding benefactors contribute blog search att ckcon 7 0 in person tickets are open join us october 27 28 2026 in mclean va register here for in person tickets hotel and location details can be found in the faq home techniques enterprise os credential dumping dcsync os credential dumping dcsync other sub techniques of os credential dumping 8 id name t1003 001 lsass memory t1003 002 security account manager t1003 003 ntds t1003 004 lsa secrets t1003 005 cached domain credentials t1003 006 dcsync t1003 007 proc filesystem t1003 008 etc passwd and etc shadow adversaries may attempt to access credentials and other sensitive information by abusing a windows domain controller s application programming interface api 1 2 3 4 to simulate the replication process from a remote domain controller using a technique called dcsync members of the administrators domain admins and enterprise admin groups or computer accounts on the domain controller are able to run dcsync to pull password data 5 from active directory which may include current and historical hashes of potentially useful accounts such as krbtgt and administrators the hashes can then in turn be used to create a golden ticket for use in pass the ticket 6 or change an account s password as noted in account manipulation 7 dcsync functionality has been included in the lsadump module in mimikatz 8 lsadump also includes netsync which performs dcsync over a legacy replication protocol 9 id t1003 006 sub technique of t1003 ⓘ tactic credential access ⓘ platforms windows contributors extrahop vincent le toux version 1 1 created 11 february 2020 last modified 24 october 2025 version permalink live version procedure examples id name description c0027 c0027 during c0027 scattered spider performed domain replication 10 g1006 earth lusca earth lusca has used a dcsync command with mimikatz to retrieve credentials from an exploited controller 11 g1004 lapsus lapsus has used dcsync attacks to gather credentials for privilege escalation routines 12 s0002 mimikatz mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources it contains functionality to acquire information about credentials in many ways including from dcsync netsync 13 8 14 15 16 g0129 mustang panda mustang panda has leveraged mimikatz dcsync feature to obtain user credentials 17 c0014 operation wocao during operation wocao threat actors used mimikatz s dcsync to dump credentials from the memory of the targeted system 18 c0024 solarwinds compromise during the solarwinds compromise apt29 used privileged accounts to replicate directory service data with domain controllers 19 20 21 g1053 storm 0501 storm 0501 has utilized dcsync to extract credentials from victims 22 mitigations id mitigation description m1015 active directory configuration manage the access control list for replicating directory changes and other permissions associated with domain controller replication 5 23 m1027 password policies ensure that local administrator accounts have complex unique passwords across all systems on the network m1026 privileged account management do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled as this is often equivalent to having a local administrator account with the same password on all systems follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers detection strategy id name analytic id analytic description det0594 detection of unauthorized dcsync operations via replication api abuse an1632 detects unauthorized invocation of replication operations dcsync via directory replication service drs often executed by threat actors using mimikatz or similar tools from non dc endpoints references microsoft 2017 december 1 ms drsr directory replication service drs remote protocol retrieved december 4 2017 microsoft n d idl_drsgetncchanges opnum 3 retrieved december 4 2017 sambawiki n d drsuapi retrieved december 4 2017 wine api n d samlib dll retrieved november 17 2024 metcalf s 2015 september 25 mimikatz dcsync usage exploitation and detection retrieved august 7 2017 schroeder w 2015 september 22 mimikatz and dcsync and extrasids oh my retrieved september 23 2024 warren j 2017 july 11 manipulating user passwords with mimikatz retrieved december 4 2017 deply b le toux v 2016 june 5 module lsadump retrieved august 7 2017 microsoft 2017 december 1 ms nrpc netlogon remote protocol retrieved december 6 2017 parisi t 2022 december 2 not a simulation crowdstrike investigations reveal intrusion campaign targeting telco and bpo companies retrieved june 30 2023 chen j et al 2022 delving deep an analysis of earth lusca s operations retrieved july 1 2022 mstic dart m365 defender 2022 march 24 dev 0537 criminal actor targeting organizations for data exfiltration and destruction retrieved may 17 2022 deply b n d mimikatz retrieved september 29 2015 grafnetter m 2015 october 26 retrieving dpapi backup keys from active directory retrieved december 19 2017 the australian cyber security centre acsc the canadian centre for cyber security cccs the new zealand national cyber security centre nz ncsc cert new zealand the uk national cyber security centre uk ncsc and the us national cybersecurity and communications integration center nccic 2018 october 11 joint report on publicly available hacking tools retrieved march 11 2019 strategic cyber llc 2020 november 5 cobalt strike advanced threat tactics for penetration testers retrieved april 13 2021 lior rochberger tom fakterman robert falcone 2023 september 22 cyberespionage attacks against southeast asian government linked to stately taurus aka mustang panda retrieved september 9 2025 dantzig m v schamper e 2019 december 19 operation wocao shining a light on one of china s hidden hacking groups retrieved october 8 2020 microsoft 365 defender team 2020 december 28 using microsoft 365 defender to protect against solorigate retrieved january 7 2021 mstic cdoc 365 defender research team 2021 january 20 deep dive into the solorigate second stage activation from sunburst to teardrop and raindrop retrieved january 22 2021 crowdstrike 2022 january 27 early bird catches the wormhole observations from the stellarparticle campaign retrieved february 7 2022 microsoft threat intelligence 2025 august 27 storm 0501 s evolving techniques lead to cloud based ransomware retrieved october 19 2025 microsoft n d how to grant the replicating directory changes permission for the microsoft metadirectory services adma service account retrieved december 4 2017 core objects all core att ck objects all none matrices tactics techniques sub techniques defenses all defenses all none mitigations assets detection strategies analytics data components cti all cti all none groups software campaigns reference all reference all none resources domains all domains all none enterprise mobile ics reset filters contact us terms of use privacy policy website changelog cookie preferences 2015 2026 the mitre corporation mitre att ck and att ck are registered trademarks of the mitre corporation