How DCSync Attack Helps Hackers Steal Password Hashes Silently from Active Directory

Active Directory is the beating heart of identity in most enterprises, and its single most valuable secret is the password hash of every user, service, and machine account. A DCSync attack lets an adversary walk out with those hashes without ever logging into a domain controller, dropping a tool on it, or reading the NTDS.dit database off disk. Instead, the attacker simply asks a domain controller to hand the secrets over, using the very same replication protocol that domain controllers use to synchronize with one another. Technically, DCSync impersonates a domain controller and issues a directory-replication request over the Microsoft Directory Replication Service Remote Protocol (MS-DRSR). It binds to the DRSUAPI RPC interface and calls IDL_DRSGetNCChanges to request the credential attributes of one account, a handful, or every account in the domain. The domain controller, believing it is talking to a peer DC, replies with NTLM hashes, Kerberos keys, and password history. First weaponized in Mimikatz by Benjamin Delpy and Vincent Le Toux, DCSync is now a standard move in nearly every ransomware and nation-state playbook. MITRE ATT&CK catalogs it as T1003.006 (OS Credential Dumping: DCSync). For a broader view of where it fits in an intrusion,…