The magnet problem
Mimikatz earned its legend — and then the industry spent a decade turning it into a tripwire. The binary is hashed. Its command lines are pattern-matched. sekurlsa::dcsync is, to a modern EDR, practically a confession. Even its legitimate descendants inherit the suspicion: anything touching LSASS, anything requesting replication rights, anything named like a credential tool gets the second look by default. The technique isn't burned — the artifact is. DCSync, underneath everything, is a documented directory replication call; the API was never malicious, only the caller's reputation. So the engineering question becomes: how do you make the call without inheriting the reputation?
The library, not the tool
Our answer is the same library defenders audit with. The discovery module embeds a managed wrapper around DSInternals — the open-source, defender-used .NET directory library — and hosts it through the same unmanaged CLR pipeline described in note N.09: no powershell.exe, no Add-Type, no managed binary on disk. The assemblies travel encrypted inside the module and are decrypted only in memory. When the operator tasks a DCSync, the call that reaches the domain controller is a directory replication request issued by a process with no offensive heritage — the difference between a known criminal and a polite stranger asking the same question. Five operation scopes: a single account, the admins set, everything, krbtgt for golden-ticket material, or machine accounts.
The API was never malicious. Only the caller's reputation was.
How it runs
The module itself is ~7 MB and arrives through the depot — one-time token, per-module key, cover-named request — carrying its own CLR assemblies, so the agent core stays small and the host stays quiet until tasked. Execution is deliberately shaped: a short-lived child process, created with a spoofed parent and non-Microsoft DLLs blocked, does the managed work and hands results back through shared memory — no output pipes, no temp files. The memory that held secrets is scrubbed on the way out. Authentication is whatever the operation already owns: the current context, explicit credentials, a stolen token, or pass-the-hash — the module wields privilege you have; it never pretends to grant you any.
The full surface
DCSync is one row. The module's real value is the whole recon-to-keys surface behind one tasking interface — each row below a classic operation that historically meant a separate tool, a separate binary, a separate signature set:
| Operation | What the operator gets |
|---|---|
| Kerberoast | SPN-bearing accounts enumerated, service tickets requested (RC4/AES) — hashcat-ready output |
| AS-REP roast | Accounts without pre-authentication found; hashes requested on demand |
| GPP harvest | SYSVOL group-policy XML parsed — Groups, Services, Scheduled Tasks, Data Sources, Drives, Printers — for the cPassword era's leftovers |
| NETLOGON crawl | Logon scripts mined for embedded credentials |
| ADCS review | CAs and certificate templates enumerated; ESC1–11, ESC13–14 conditions checked from template and CA ACLs |
| Delegation triad | Unconstrained, constrained (with S4U), and resource-based — one sweep |
| DCSync | Replication via the managed library: single / admins / all / krbtgt / computers |
| LAPS | Local admin passwords read where the operator's rights reach |
| Shadow credentials | msDS-KeyCredentialLink add / list / remove — account takeover that resets no password |
| Domain DPAPI backup key | The master key for every domain-protected DPAPI blob, retrieved through the same pipeline |
And because recon is only worth what you can do with it, the module finishes the sentence: for each finding it generates the matching attack command — pass-the-hash invocations, ticket requests, golden-ticket material — so the operator moves from discovery to action without a second toolchain. Export feeds your analysis tooling (BloodHound-shaped) when you want the graph instead of the list.
The honest limits
Three properties we will not round off. Replication needs rights: DCSync works because the account you wield holds replication permissions — the module quiets the caller, it cannot quiet the call; anyone auditing replication events will see the operation itself. The child is a birth: fork-and-run means one short-lived process creation, parent-spoofed and DLL-restricted — attributed and minimized, but present; lineage analytics earn their keep here. The fetch is the seam: a 7 MB on-demand download, shortly before directory-touching behavior, is exactly the correlation we tell defenders to build in the telemetry map — we narrowed it with tokens and cover names, we did not delete it.
The defender's angle
Write these rules and this note becomes a gift. Replication from the wrong host: directory-replication events (4662 with the DS-Replication GUIDs) sourced from any machine that isn't a domain controller is as close to a free conviction as this industry offers — legitimate replication is a DC-to-DC habit. Machine accounts that replicate are the second tell. Key-credential writes: alert on msDS-KeyCredentialLink modifications — shadow credentials are quiet precisely because nobody watches the attribute. SYSVOL at scale: a single host parsing policy XML across the share is a harvest pattern, not an admin habit. Certificate authority drift: template ACL changes followed by unusual enrollment are the ESC family's heartbeat — template auditing catches what endpoint tooling can't see. The artifact may change its face; the operations have physics, and the physics are watchable.
Next note: What each bypass still costs you. Direct and indirect syscalls, unhooking, stack spoofing, sleep obfuscation, ETW tampering — the bypass shelf with meter readings, and why single-trick implants age badly.