🛡️ Security

DCSync

A credential-theft technique in which an attacker impersonates a domain controller and asks a real one to replicate account data, including password hashes, over the normal Active Directory replication protocol.

📚 Deep Dive

Learn Article

How to Spot DCSync and Mailbox Harvesting After a Web Server Is Breached

Credential replication and bulk email collection both abuse legitimate protocols, so detection means baselining normal activity and alerting on the exceptions.

intermediate 5 min read

Back to Glossary