Hackers Impersonate Domain Controllers to Steal Active Directory Password Hashes via DCSync

Trellix-reported attackers abuse Active Directory replication (DCSync via DRSUAPI) to impersonate domain controllers and remotely harvest NTLM password hashes and Kerberos key material without running code on the DCs; stealing the KRBTGT hash enables Golden…

Per Trellix reporting carried by Cyber Security News and GBHackers (both dated 2026-09-10), threat actors increasingly use the DCSync technique to compromise Active Directory without directly attacking domain controllers. Using credentials with Domain Admin or directory-replication rights, they impersonate a domain controller and invoke the DRSUAPI method DRSGetNCChanges to request replication data, retrieving NTLM password hashes and Kerberos key material remotely. The technique requires no code execution on the DC and no LSASS dumping, so malicious traffic closely resembles legitimate DRS/RPC replication. With the captured KRBTGT account hash, attackers can forge long-lived Golden Tickets that persist even after password resets. The two reports are consistent and differ only in emphasis: defenders should limit and audit replication permissions (especially delegated service accounts), monitor Windows Security Event ID 4662 and DRS/RPC telemetry, alert on replication requests originating from non-domain-controller systems, and enforce MFA and tiered administrative access.

• Technique: DCSync — abuse of legitimate Active Directory replication via the DRSUAPI protocol; no code execution on domain controllers is required.
• Mechanism: attackers with Domain Admin or replication-privileged credentials invoke DRSGetNCChanges to retrieve NTLM password hashes and Kerberos key material.
• Stealth: the attack avoids LSASS dumping on the domain controller, so malicious replication traffic mimics normal DRS/RPC activity.
• Impact: theft of the KRBTGT account hash enables forging Golden Tickets that survive password resets and grant persistent, highly privileged domain access.
• Attribution: both reports cite Trellix; no specific threat group, CVE id, or victim counts were provided in either report.
• Detection: monitor Windows Security Event ID 4662, DRS/RPC telemetry, and replication requests issued by non-domain-controller hosts.
• Mitigation: restrict and audit directory replication rights (including delegated service accounts), enforce MFA, and adopt tiered administrative access.