What is DCSync and what does it do?

DCSync is a feature in mimikatz that allows an attacker to simulate a domain controller's replication behavior and request password hashes for all domain users from a legitimate domain controller using the DRS (Directory Replication Service) protocol. It is commonly used to harvest credential material for lateral movement or privilege escalation in Active Directory environments. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [An interesting way of bypassing Windows Attachment Manager](/news/an-interesting-way-of-bypassing-windows-attachment-manager) - [Penetration Techniques - Exploitation of Nine Windows Privileges](/news/penetration-techniques-exploitation-of-nine-windows-privileges) - [Penetration Techniques - Pass the Hash with Remote Desktop (Restricted Admin Mode)](/news/penetration-techniques-pass-the-hash-with-remote-desktop-restricted-admin-mode)