Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Training Camp • Cybersecurity Glossary
A DCSync attack abuses Active Directory replication privileges to impersonate a domain controller and steal password hashes, including krbtgt, remotely.
DCSync Attack Definition: A DCSync attack abuses Active Directory replication privileges to impersonate a domain controller and steal password hashes, including krbtgt, remotely.
A DCSync attack is an Active Directory technique in which an adversary with sufficient replication privileges abuses the Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a domain controller and request password hashes for any account, including the krbtgt key. Because it uses legitimate replication APIs rather than touching a domain controller's disk, it can extract credentials remotely and stealthily. Captured hashes enable pass-the-hash, golden ticket, and other credential-based attacks, making DCSync a high-impact post-exploitation method.
Turn knowledge into credentials with our instructor-led cybersecurity boot camps.
View All Courses →