Skip to content

Instantly share code, notes, and snippets.

@silence-is-best

silence-is-best/gist:25ae0929c277642e86ecf592598a3254

Created Sep 14, 2020
Star
Embed
What would you like to do?
Learn more about clone URLs
Download ZIP
DCSync detection
Raw
gistfile1.txt
alert tcp any any -> [!<domaincontrollers to exclude here] [49152:65535] (msg:"Possible DCSync Detected"; flow:to_server,established; flags:PA; content:"|00 03 10 00 00 00|"; depth:8; content:"|03 00|"; distance:14; classtype:attempted-admin; sid:20166316;)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment