Cybersecurity Q&A
Browse concise answers derived from our published, source-linked cybersecurity coverage.
How can defenders detect DCSync backdoors that grant replication rights to non-privileged users?
Defenders can use automated tools like ACLight, which enumerates ACLs in Active Directory to find privileged accounts that are not members of high-privilege groups (shadow admins). It generates reports like "Privileged Accounts - Layers Analysis.txt" to flag users with DCSync permissions. The article recommends using ACLight for this detection.
What are some practical methods to execute DCSync from a domain-joined machine as a low-privileged user that has been given DCSync rights?
The user can run mimikatz directly if logged in, or use `runas` or PowerShell's `Start-Process` with credentials to execute a batch file containing the DCSync command. For example: `mimikatz.exe privilege::debug "lsadump::dcsync /domain:test.com /user:administrator /csv"`. Note that wmic cannot be used locally with alternate credentials. Refer to [Domain Penetration - Method to Export All Domain User Hashes Using DCSync](/news/domain-penetration-method-to-export-all-domain-user-hashes-using-dcsync) for more.
How can an attacker maintain persistence in a domain using DCSync without being in high-privilege groups?
An attacker with Domain Admin privileges can add three specific ACEs (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes with a different GUID) to a regular user account using PowerShell tools like PowerView. This grants that user DCSync rights, creating a "Shadow Admin" that can export all domain hashes unnoticed.
What is DCSync and what is its primary use in domain penetration?
DCSync is a feature in mimikatz that exploits the Directory Replication Service (DRS) protocol to replicate user credentials from a domain controller, allowing an attacker to export hashes of all domain users. It requires permissions like Domain Admins or a domain controller's computer account. For details, see [Domain Penetration - DCSync](/news/domain-penetration-dcsync).
How can an attacker use a low-privilege user with DCSync rights to export domain hashes without interactive logon?
Using PowerShell, the attacker can start a process as the low-privilege user with Start-Process and -Credential, then execute mimikatz commands to dump hashes. Alternatively, runas with a batch file can run DCSync in the background, exporting results to a text file. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Use powershell to find a writable windows service](/news/use-powershell-to-find-a-writable-windows-service) - [Windows Shellcode Study Notes - Extraction and Testing of Shellcode](/news/windows-shellcode-study-notes-extraction-and-testing-of-shellcode)
What tool can automatically detect DCSync backdoors and other privileged accounts in Active Directory?
ACLight (from CyberArk) is a tool that enumerates all Active Directory ACLs and flags privileged accounts, including those with DCSync permissions. It requires PowerShell v3.0 and domain user privileges, producing reports that identify 'Shadow Admins' not in high-privilege groups. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Use powershell to find a writable windows service](/news/use-powershell-to-find-a-writable-windows-service) - [Windows Shellcode Study Notes - Extraction and Testing of Shellcode](/news/windows-shellcode-study-notes-extraction-and-testing-of-shellcode)
How can an attacker maintain domain persistence by adding DCSync rights to a regular user?
An attacker with Domain Admin or Enterprise Admin privileges can add three specific ACEs (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and another replication GUID) to a regular user's ACL. This grants the user DCSync rights, allowing them to export all domain hashes and persist as a 'Shadow Admin'. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Use powershell to find a writable windows service](/news/use-powershell-to-find-a-writable-windows-service) - [Windows Shellcode Study Notes - Extraction and Testing of Shellcode](/news/windows-shellcode-study-notes-extraction-and-testing-of-shellcode)
What privileges are required to perform a DCSync attack and export domain user hashes?
To execute DCSync, an attacker needs permissions of users in the Administrators, Domain Admins, Enterprise Admins groups, or the computer account of the domain controller. These high-level privileges allow replication of credentials via the DRS protocol. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Use powershell to find a writable windows service](/news/use-powershell-to-find-a-writable-windows-service) - [Windows Shellcode Study Notes - Extraction and Testing of Shellcode](/news/windows-shellcode-study-notes-extraction-and-testing-of-shellcode)
What is DCSync and what protocol does it use to replicate user credentials?
DCSync is a technique in mimikatz that uses the Directory Replication Service (DRS) protocol to replicate user credentials from a domain controller. It calls IDL_DRSGetNCChanges to export password hashes of all domain users, enabling attackers to escalate privileges or move laterally. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Use powershell to find a writable windows service](/news/use-powershell-to-find-a-writable-windows-service) - [Windows Shellcode Study Notes - Extraction and Testing of Shellcode](/news/windows-shellcode-study-notes-extraction-and-testing-of-shellcode)
What protocol does DCSync exploit to replicate credentials?
DCSync exploits the Directory Replication Service (DRS) protocol, specifically the IDL_DRSGetNCChanges method, to request replication of user credentials from a domain controller. This protocol is normally used by domain controllers to synchronize directory information. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [An interesting way of bypassing Windows Attachment Manager](/news/an-interesting-way-of-bypassing-windows-attachment-manager) - [Penetration Techniques - Exploitation of Nine Windows Privileges](/news/penetration-techniques-exploitation-of-nine-windows-privileges) - [Penetration Techniques - Pass the Hash with Remote Desktop (Restricted Admin Mode)](/news/penetration-techniques-pass-the-hash-with-remote-desktop-restricted-admin-mode)
How can DCSync backdoors be detected automatically?
Automated detection can be performed using tools like ACLight, which enumerates ACLs of all Active Directory objects and identifies users with excessive privileges (e.g., DCSync rights) that are not members of built-in admin groups. ACLight generates reports listing privileged accounts, including 'Irregular Accounts' that pose a security risk. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [An interesting way of bypassing Windows Attachment Manager](/news/an-interesting-way-of-bypassing-windows-attachment-manager) - [Penetration Techniques - Exploitation of Nine Windows Privileges](/news/penetration-techniques-exploitation-of-nine-windows-privileges) - [Penetration Techniques - Pass the Hash with Remote Desktop (Restricted Admin Mode)](/news/penetration-techniques-pass-the-hash-with-remote-desktop-restricted-admin-mode)
How can an attacker maintain persistence using DCSync without being a Domain Admin?
An attacker can grant DCSync rights to a regular domain user by adding specific Access Control Entries (ACEs) to the domain object using tools like PowerView. The required ACEs are DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes (with a specific GUID). This 'Shadow Admin' can then export all domain hashes without being a member of high-privilege groups. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [An interesting way of bypassing Windows Attachment Manager](/news/an-interesting-way-of-bypassing-windows-attachment-manager) - [Penetration Techniques - Exploitation of Nine Windows Privileges](/news/penetration-techniques-exploitation-of-nine-windows-privileges) - [Penetration Techniques - Pass the Hash with Remote Desktop (Restricted Admin Mode)](/news/penetration-techniques-pass-the-hash-with-remote-desktop-restricted-admin-mode)
What are the prerequisites to perform a DCSync attack?
To perform DCSync, an attacker must have compromised an account that is a member of one of the following groups: Domain Admins, Enterprise Admins, Administrators on the domain controller, or the domain controller's computer account. These privileges allow the use of the IDL_DRSGetNCChanges method to replicate credentials. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [An interesting way of bypassing Windows Attachment Manager](/news/an-interesting-way-of-bypassing-windows-attachment-manager) - [Penetration Techniques - Exploitation of Nine Windows Privileges](/news/penetration-techniques-exploitation-of-nine-windows-privileges) - [Penetration Techniques - Pass the Hash with Remote Desktop (Restricted Admin Mode)](/news/penetration-techniques-pass-the-hash-with-remote-desktop-restricted-admin-mode)
What is DCSync and what does it do?
DCSync is a feature in mimikatz that allows an attacker to simulate a domain controller's replication behavior and request password hashes for all domain users from a legitimate domain controller using the DRS (Directory Replication Service) protocol. It is commonly used to harvest credential material for lateral movement or privilege escalation in Active Directory environments. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [An interesting way of bypassing Windows Attachment Manager](/news/an-interesting-way-of-bypassing-windows-attachment-manager) - [Penetration Techniques - Exploitation of Nine Windows Privileges](/news/penetration-techniques-exploitation-of-nine-windows-privileges) - [Penetration Techniques - Pass the Hash with Remote Desktop (Restricted Admin Mode)](/news/penetration-techniques-pass-the-hash-with-remote-desktop-restricted-admin-mode)
What is the recommended defense against Logon Scripts persistence?
The primary defense is to monitor the registry key `HKCU\Environment\UserInitMprLogonScript` for any unauthorized modifications. Unusual or unexpected scripts set as the value indicate a potential persistence mechanism. Additionally, security teams should track changes to environment variables under `HKCU\Environment`. For more context, refer to the [Logon Scripts article](/news/use-logon-scripts-to-maintain-persistence).
Does the Logon Scripts technique allow execution before antivirus software starts?
Yes, the article demonstrates that Logon Scripts execute before certain antivirus software like 360, allowing malicious scripts to perform restricted operations (e.g., creating environment variables via WMI) without being blocked. This was tested by writing a value to the registry within the logon script and confirming it succeeded. For details, check the [Logon Scripts persistence article](/news/use-logon-scripts-to-maintain-persistence).
How can attackers bypass 360 antivirus's interception of WMI calls when setting environment variables for persistence?
360 antivirus intercepts WMI calls like `wmic ENVIRONMENT create`, but attackers can bypass this by writing directly to the registry using PowerShell. For example, `New-ItemProperty "HKCU:\Environment\" COR_ENABLE_PROFILING -value "1" -propertyType string` achieves the same effect as the WMI command without triggering antivirus alerts, as described in the [Logon Scripts article](/news/use-logon-scripts-to-maintain-persistence).
What is the Logon Scripts persistence technique and how is it configured?
The Logon Scripts persistence technique involves setting the `UserInitMprLogonScript` registry value under `HKCU\Environment` to point to a script (e.g., a .bat file). When the user logs on, the script executes automatically, providing a stealthy method for maintaining access. For a full walkthrough, see [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence).
What is the recommended defense against Logon Scripts persistence attacks?
The primary defense is to monitor changes to the registry key `HKCR\Environment\UserInitMprLogonScript`. Any unauthorized creation or modification of this key should trigger an alert. Additionally, organizations should enforce strict access controls on the registry and use endpoint detection and response (EDR) tools to detect suspicious logon script executions. --- **Related reading:** - [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence) — original article - [Penetration Techniques - Obtaining Net-NTLM Hash via HTTP Protocol](/news/penetration-techniques-obtaining-net-ntlm-hash-via-http-protocol) - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Pupy Exploitation Analysis - Features on Windows Platform](/news/pupy-exploitation-analysis-features-on-windows-platform)
Why might an attacker replace WMI commands with registry modifications when using Logon Scripts?
Antivirus software like 360 often intercepts WMI calls used to create environment variables. Since adding environment variables via WMI is equivalent to writing to the registry (specifically `HKCU\Environment`), an attacker can bypass the WMI interception by directly writing to the registry using PowerShell or similar tools. This makes the technique stealthier and more reliable. --- **Related reading:** - [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence) — original article - [Penetration Techniques - Obtaining Net-NTLM Hash via HTTP Protocol](/news/penetration-techniques-obtaining-net-ntlm-hash-via-http-protocol) - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Pupy Exploitation Analysis - Features on Windows Platform](/news/pupy-exploitation-analysis-features-on-windows-platform)