↳ GitHub sourceAnalytics ruleHigh

Non Domain Controller Active Directory Replication

Description

'This query detects potential attempts by non-computer accounts (non domain controllers) to retrieve/synchronize an active directory object leveraging directory replication services (DRS). A Domain Controller (computer account) would usually be performing these actions in a domain environment. Another detection rule can be created to cover domain controllers accounts doing at rare times. A domain user with privileged permissions to use directory replication services is rare.'

Rule type: Scheduled
Version: 1.0.6
Declared status: Available
Query frequency: 1d
Query period: 7d
Trigger: gt 0

Declared MITRE coverage

CredentialAccess T1003.006

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

SecurityEvents WindowsSecurityEvents

Data types

SecurityEvent

KQL query

Original query, unchanged.

// Enter a reference list of hostnames for your DC servers
//let DCServersList = dynamic (["DC01.simulandlabs.com","DC02.simulandlabs.com"]);
SecurityEvent
//| where Computer in (DCServersList)
| where EventID == 4662 and ObjectServer == 'DS'
| where AccountType != 'Machine'
| where Properties has '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' //DS-Replication-Get-Changes
    or Properties has '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' //DS-Replication-Get-Changes-All
    or Properties has '89e95b76-444d-4c62-991a-0facbeda640c' //DS-Replication-Get-Changes-In-Filtered-Set
| project TimeGenerated, Account, Activity, Properties, SubjectLogonId, Computer
| join kind=leftouter
(
    SecurityEvent
    //| where Computer in (DCServersList)
    | where EventID == 4624 and LogonType == 3
    | where AccountType != 'Machine'
    | project TargetLogonId, IpAddress, Computer
)
on $left.SubjectLogonId == $right.TargetLogonId and $left.Computer == $right.Computer
| project-reorder TimeGenerated, Computer, Account, IpAddress
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountNTDomain = tostring(split(Account, "\\")[0]), AccountName = tostring(split(Account, "\\")[1])

Declared entities

AccountHostIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Windows Security Events/Analytic Rules/NonDCActiveDirectoryReplication.yaml ↗
Commit: 9800e51 ↗
Source identifier: b9d2eebc-5dcb-4888-8165-900db44443ab

Additional source files 3

Solutions/Windows Security Events/Analytic Rules/NonDCActiveDirectoryReplication.yamlsource ↗Detections/SecurityEvent/NonDCActiveDirectoryReplication.yamlmigration-note ↗Solutions/Windows Security Events/Data/Solution_Windows Security Events.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.