Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add mukul975/Anthropic-Cybersecurity-Skills/hunting-for-dcsync-attacksCompatible with
Supported agents
| name | hunting-for-dcsync-attacks |
| description | Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts. |
| domain | cybersecurity |
| subdomain | threat-hunting |
| tags | - threat-hunting - dcsync - active-directory - credential-access - t1003.006 - mimikatz - windows - dfir |
| version | '1.0' |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | - Application Protocol Command Analysis - Network Isolation - Network Traffic Analysis - Client-server Payload Profiling - Platform Monitoring |
| nist_csf | - DE.CM-01 - DE.AE-02 - DE.AE-07 - ID.RA-05 |
| Concept | Description |
|---|---|
| DCSync | Technique abusing AD replication protocol to extract password hashes |
| Event ID 4662 | Directory Service Access audit event |
| DS-Replication-Get-Changes | GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 |
| DS-Replication-Get-Changes-All | GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 |
| AccessMask 0x100 | Control Access right indicating extended rights verification |
| T1003.006 | OS Credential Dumping: DCSync |
| Tool | Purpose |
|---|---|
| Windows Event Viewer | Direct event log analysis |
| Splunk | SIEM correlation of Event 4662 |
| Elastic Security | Detection rules for DCSync patterns |
| Mimikatz lsadump::dcsync | Attack tool used to perform DCSync |
| Impacket secretsdump.py | Python-based DCSync implementation |
| BloodHound | Identify accounts with replication rights |
Hunt ID: TH-DCSYNC-[DATE]-[SEQ]
Technique: T1003.006
Domain Controller: [DC hostname]
Subject Account: [Account performing replication]
Source IP: [Non-DC IP address]
GUID Accessed: [Replication GUID]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Disable account, reset krbtgt, investigate]
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionhunting-for-dcsync-attacksExecute the skills CLI command in your project's root directory to begin installation:
epx add mukul975/Anthropic-Cybersecurity-Skills/hunting-for-dcsync-attacksFetches hunting-for-dcsync-attacks from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/hunting-for-dcsync-attacks
Restart Cursor to activate hunting-for-dcsync-attacks. Access via /hunting-for-dcsync-attacksin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
performing-initial-access-with-evilginx3
mukul975/Anthropic-Cybersecurity-Skills · performing-initial-access-with-evilginx3 · same repo
performing-steganography-detection
mukul975/Anthropic-Cybersecurity-Skills · performing-steganography-detection · same repo
performing-network-packet-capture-analysis
mukul975/Anthropic-Cybersecurity-Skills · performing-network-packet-capture-analysis · same repo
hunting-credential-stuffing-attacks
mukul975/Anthropic-Cybersecurity-Skills · hunting-credential-stuffing-attacks · same repo
scanning-container-images-with-grype
mukul975/Anthropic-Cybersecurity-Skills · scanning-container-images-with-grype · same repo
executing-red-team-engagement-planning
mukul975/Anthropic-Cybersecurity-Skills · executing-red-team-engagement-planning · same repo
hunting-for-dcsync-attacks has been reliable in day-to-day use. Documentation quality is above average for community skills.
We added hunting-for-dcsync-attacks from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
hunting-for-dcsync-attacks has been reliable in day-to-day use. Documentation quality is above average for community skills.
I recommend hunting-for-dcsync-attacks for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
Useful defaults in hunting-for-dcsync-attacks — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
hunting-for-dcsync-attacks fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
Registry listing for hunting-for-dcsync-attacks matched our evaluation — installs cleanly and behaves as described in the markdown.
hunting-for-dcsync-attacks reduced setup friction for our internal harness; good balance of opinion and flexibility.
We added hunting-for-dcsync-attacks from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
Solid pick for teams standardizing on skills: hunting-for-dcsync-attacks is focused, and the summary matches what you get after install.
showing 1-10 of 71