Answers from the documentation; checking which model is on duty
Hi - I answer from the OpenSmartRoute documentation: routing, the API, plans and quotas, self-hosting. Ask away, or open a support ticket if you need a person.
Grounded in the docs - follow a source before acting on it.
Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-con
Imported from mukul975/anthropic-cybersecurity-skills (skills/hunting-for-dcsync-attacks/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill hunting-for-dcsync-attacks. Copyright stays with the author (Apache-2.0).
Hunting for DCSync Attacks
When to Use
When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)
After detecting Mimikatz or similar tools in the environment
During incident response involving Active Directory compromise
When monitoring for unauthorized domain replication requests
During purple team exercises testing AD attack detection
Prerequisites
Windows Security Event Log forwarding enabled (Event ID 4662)
Audit Directory Service Access enabled via Group Policy
Domain Computers SACL configured on Domain Object for machine account detection
SIEM with Windows event data ingested (Splunk, Elastic, Sentinel)
Knowledge of legitimate domain controller accounts and replication partners
Workflow
Enable Auditing: Ensure Audit Directory Service Access is enabled on domain controllers.
Collect Events: Gather Windows Event ID 4662 with AccessMask 0x100 (Control Access).
Filter Replication GUIDs: Search for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
Identify Non-DC Sources: Flag events where SubjectUserName is not a domain controller machine account.
Correlate with Network: Cross-reference source IPs against known DC addresses.
Validate Findings: Exclude legitimate replication tools (Azure AD Connect, SCCM).
Install hunting-for-dcsync-attacks and it becomes one more candidate the router can pick - when it fits.
A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.
When a provider is down or over quota the request moves on; the trace says it did.
Use it
Copy one of these into your project. Installing also returns the manifest and these snippets.
# after Install: the listing is in your workspace's routing pool - a plan picks it for its slotcurl-s-X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'
Manifest
An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.
{
"ocm": "1",
"id": "mukul975-anthropic-cybersecurity-skills-hunting-for-dcsy-bed99f",
"kind": "skill",
"name": "hunting-for-dcsync-attacks",
"description": "Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.",
"publisher": "mukul975",
"version": "1.0.0",
"capabilities": {
"domains": [
"coding"
],
"tags": [
"skill-md",
"threat-hunting",
"dcsync",
"active-directory",
"credential-access",
"t1003-006",
"mimikatz",
"windows",
"dfir",
"skills-sh"
],
"languages": [
"en"
]
},
"quality_prior": 0.6,
"examples": [
"Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse."
],
"primary": false,
"metadata": {
"source": {
"provider": "skills.sh",
"repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
"path": "skills/hunting-for-dcsync-attacks/SKILL.md",
"ref": "HEAD",
"url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/hunting-for-dcsync-attacks/SKILL.md",
"key": "mukul975/anthropic-cybersecurity-skills/skills/hunting-for-dcsync-attacks/SKILL.md"
},
"license": "Apache-2.0"
},
"instructions": "# Hunting for DCSync Attacks\n\n## When to Use\n\n- When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)\n- After detecting Mimikatz or similar tools in the environment\n- During incident response involving Active Directory compromise\n- When monitoring for unauthorized domain replication requests\n- During purple team exercises testing AD attack detection\n\n## Prerequisites\n\n- Windows Security Event Log forwarding enabled (Event ID 4662)\n- Audit Directory Service Access enabled via Group Policy\n- Domain Computers SACL configured on Domain Object for machine account detection\n- SIEM with W",
"cost": {
"context_tokens": 661
}
}
Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-hunting-for-dcsy-bed99f/manifest?version=1.0.0
Reviews
Star ratings from people who tried it. One review per account; edit yours any time.
No reviews yet. Install it, try it, and be the first to rate it.
