Possible DC Replication (DCSync)
Detects suspicious attempts to replicate Active Directory data from a Domain Controller using the DCSync technique based on the Defender for identity module. This behavior may indicate an attacker attempting to extract sensitive credentials (such as password hashes) by mimicking domain replication requests
CQL · Falcon Next-Gen SIEMCopy query
#Vendor="microsoft"
| #event.dataset="defender-identity.IdentityDirectoryEvents"
| event.action = "directory services replication"
| network.protocol = drsr
| groupBy([user.name,Vendor.properties.AdditionalFields.FROM.DEVICE, source.address], function=[count(as=replication_count),collect(fields=[Vendor.properties.DestinationDeviceName,Vendor.properties.DestinationIPAddress,Vendor.properties.AdditionalFields.DestinationComputerOperatingSystem,Vendor.properties.AdditionalFields.SourceComputerOperatingSystemType]),min(@timestamp, as=start_time),max(@timestamp, as=end_time)])
| start_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=start_time, timezone="UTC")
| end_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=end_time, timezone="UTC")
| drop([start_time, end_time])
| sort([replication_count], order=desc)possible_dc_replication_dcsync.yml
T1003.006
Kundan Kumar
Detection
Identity
Identity
2026-05-08
2026-05-08
