Qilin Ransomware Abuses Active Directory Replication with DCSync Attacks

Key Takeaways

• Qilin ransomware has been observed leveraging a sophisticated Active Directory replication abuse technique.
• The attack, known as DCSync, allows the ransomware to extract critical domain credentials, including KRBTGT and NTLM hashes.
• The compromise was identified through anomalous Windows Security Event ID 4662 entries, specifically a high volume of replication requests from an unauthorized built-in Administrator account.
• This method enables privilege escalation and credential theft without direct interaction with a domain controller’s disk.
• Defenders should focus on identity-based detection rules for Event ID 4662 to flag unauthorized replication attempts.

Qilin Ransomware Exploits Active Directory for Credential Theft via DCSync

Recent investigations into a Qilin ransomware incident have uncovered a highly surreptitious privilege escalation method. The attackers exploited Active Directory’s inherent replication mechanisms to illicitly obtain sensitive domain credentials, including the highly prized KRBTGT hash and NTLM password hashes for all accounts within the affected domain.

Unmasking the DCSync Attack

Security researcher Maurice Fielenbach posted details of his analysis, pinpointing the abuse by identifying unusual patterns in Windows Security logs. Fielenbach observed that the environment’s legitimate Microsoft Entra Connect synchronization account (an MSOL_* account) consistently generated directory replication activity every two minutes, with timestamps like 01:19, 01:21, and 01:23 confirming this regular rhythm.

However, at 01:25, this established pattern was disrupted. Hundreds of Event ID 4662 entries began appearing, but critically, these were logged under the built-in Administrator account. This account has no legitimate reason to initiate bulk replication requests, signaling a clear deviation from normal operations.

Event ID 4662 records operations targeting Active Directory objects when directory service access auditing is enabled. The malicious entries exhibited a distinctive fingerprint:

• ObjectServer: DS (Directory Service)
• AccessMask: 0x100 (Control Access)
• Properties field containing GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes)
• Properties field containing GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes-All)

The second GUID, DS-Replication-Get-Changes-All, is particularly significant. It grants access to secret domain data, including password hashes, effectively mirroring the privileges a domain controller uses for routine replication.

This specific combination of attributes is the hallmark of a DCSync attack. Popularized by offensive security tools like Mimikatz, DCSync allows an attacker to impersonate a domain controller and request password data using the Directory Replication Service Remote Protocol (MS-DRSR), all without leaving any forensic trace on a domain controller’s disk.

It’s important to note that a single Event ID 4662 with these GUIDs isn’t inherently malicious. Domain controllers continuously replicate data, and legitimate synchronization tools like Entra Connect rely on these same rights. The critical indicator in this Qilin intrusion wasn’t merely the volume of events, but the identity associated with them, as Maurice Fielenbach highlighted. The sudden surge of activity originated from a built-in Administrator account, an identity that falls outside the restricted group of principals authorized to invoke replication rights.

Analysts caution that the raw count of events can fluctuate based on the request’s scope and the audit configuration. Therefore, while volume provides supporting context, it should not be the sole trigger for detection.

What You Should Do

Defenders can establish robust detection mechanisms by focusing on the identity performing the actions rather than just event volume:

• Configure SIEM correlation rules to flag Event ID 4662 entries with an AccessMask of 0x100.
• Ensure these rules also check for the presence of either replication GUID (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 or 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2) in the properties field.
• Crucially, filter these alerts to exclude legitimate domain controller computer accounts and approved synchronization accounts (e.g., MSOL_*).
• Any identity outside this defined allowlist attempting replication requests warrants immediate and thorough investigation.
• Organizations must audit and rigorously restrict which accounts possess “Replicating Directory Changes” and “Replicating Directory Changes All” permissions.
• Enable Directory Service Access auditing on all domain controllers.
• Feed these 4662 events into your SIEM system for effective correlation and real-time alerting on unauthorized non-DC, non-sync identities.

Given Qilin’s ongoing evolution towards credential-theft-driven lateral movement, implementing DCSync detection should be considered a fundamental security control, not an advanced one.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.