Labs / Active Directory, defender view
Replication from a workstation
Find directory replication requests in 4662 events, decode the rights GUIDs, and use the logon ID to show that the sync account replicated password hashes from a workstation instead of its server.
Briefing
DCSync uses the directory replication protocol to ask a DC for password hashes, the same way another DC would. On the DC it leaves a 4662 event listing the replication rights GUIDs used.
Domain controllers and the Entra Connect sync account replicate every day, so the account name is not enough. The 4662 Logon ID matches the 4624 logon event, which says where the session came from.
DC-01 · Active Directory, defender view
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.