Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync.

Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017)

DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017)
DCSync
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1003/006  external_id: T1003.006     source_name: Microsoft DRSR Dec 2017  description: Microsoft. (2017, December 1). MS-DRSR Directory Replication Service (DRS) Remote Protocol. Retrieved December 4, 2017.  url: https://msdn.microsoft.com/library/cc228086.aspx     source_name: Microsoft GetNCCChanges  description: Microsoft. (n.d.). IDL_DRSGetNCChanges (Opnum 3). Retrieved December 4, 2017.  url: https://msdn.microsoft.com/library/dd207691.aspx     source_name: Samba DRSUAPI  description: SambaWiki. (n.d.). DRSUAPI. Retrieved December 4, 2017.  url: https://wiki.samba.org/index.php/DRSUAPI     source_name: Wine API samlib.dll  description: Wine API. (n.d.). samlib.dll. Retrieved December 4, 2017.  url: https://source.winehq.org/WineAPI/samlib.html     source_name: ADSecurity Mimikatz DCSync  description: Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved August 7, 2017.  url: https://adsecurity.org/?p=1729     source_name: Harmj0y Mimikatz and DCSync  description: Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved August 7, 2017.  url: http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/     source_name: InsiderThreat ChangeNTLM July 2017  description: Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017.  url: https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM     source_name: GitHub Mimikatz lsadump Module  description: Deply, B., Le Toux, V. (2016, June 5). module ~ lsadump. Retrieved August 7, 2017.  url: https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump     source_name: Microsoft NRPC Dec 2017  description: Microsoft. (2017, December 1). MS-NRPC - Netlogon Remote Protocol. Retrieved December 6, 2017.  url: https://msdn.microsoft.com/library/cc237008.aspx     source_name: Microsoft SAMR  description: Microsoft. (n.d.). MS-SAMR Security Account Manager (SAM) Remote Protocol (Client-to-Server) - Transport. Retrieved December 4, 2017.  url: https://msdn.microsoft.com/library/cc245496.aspx     source_name: AdSecurity DCSync Sept 2015  description: Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved December 4, 2017.  url: https://adsecurity.org/?p=1729     source_name: Harmj0y DCSync Sept 2015  description: Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved December 4, 2017.  url: http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/     