{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-hunting-for-dcsy-bed99f",
  "kind": "skill",
  "name": "hunting-for-dcsync-attacks",
  "description": "Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "threat-hunting",
      "dcsync",
      "active-directory",
      "credential-access",
      "t1003-006",
      "mimikatz",
      "windows",
      "dfir",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/hunting-for-dcsync-attacks/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/hunting-for-dcsync-attacks/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/hunting-for-dcsync-attacks/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Hunting for DCSync Attacks\n\n## When to Use\n\n- When hunting for DCSync credential theft (MITRE ATT&CK T1003.006)\n- After detecting Mimikatz or similar tools in the environment\n- During incident response involving Active Directory compromise\n- When monitoring for unauthorized domain replication requests\n- During purple team exercises testing AD attack detection\n\n## Prerequisites\n\n- Windows Security Event Log forwarding enabled (Event ID 4662)\n- Audit Directory Service Access enabled via Group Policy\n- Domain Computers SACL configured on Domain Object for machine account detection\n- SIEM with W",
  "cost": {
    "context_tokens": 661
  }
}