DCSync

{
  "id": "ATTACK:enterprise:T1003.006",
  "title": "DCSync",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1003/006",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f303a39a-6255-4b89-aecc-18c4d8ca7163",
  "external_id": "T1003.006",
  "domain": "enterprise",
  "created": "2020-02-11T18:45:34.293Z",
  "modified": "2025-10-24T17:49:36.308Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "GitHub Mimikatz lsadump Module",
      "url": "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump"
    },
    {
      "source_name": "ADSecurity Mimikatz DCSync",
      "url": "https://adsecurity.org/?p=1729"
    },
    {
      "source_name": "AdSecurity DCSync Sept 2015",
      "url": "https://adsecurity.org/?p=1729"
    },
    {
      "source_name": "Microsoft DRSR Dec 2017",
      "url": "https://msdn.microsoft.com/library/cc228086.aspx"
    },
    {
      "source_name": "Microsoft NRPC Dec 2017",
      "url": "https://msdn.microsoft.com/library/cc237008.aspx"
    },
    {
      "source_name": "Microsoft GetNCCChanges",
      "url": "https://msdn.microsoft.com/library/dd207691.aspx"
    },
    {
      "source_name": "Microsoft SAMR",
      "url": "https://msdn.microsoft.com/library/cc245496.aspx"
    },
    {
      "source_name": "Samba DRSUAPI",
      "url": "https://wiki.samba.org/index.php/DRSUAPI"
    },
    {
      "source_name": "Harmj0y DCSync Sept 2015",
      "url": "http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/"
    },
    {
      "source_name": "Harmj0y Mimikatz and DCSync",
      "url": "https://blog.harmj0y.net/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/"
    },
    {
      "source_name": "InsiderThreat ChangeNTLM July 2017",
      "url": "https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM"
    },
    {
      "source_name": "Wine API samlib.dll",
      "url": "https://strontic.github.io/xcyclopedia/library/samlib.dll-0BDF6351009F6EBA5BA7E886F23263B1.html"
    }
  ]
}