Tag:impacket

All the articles with the tag "impacket".

• Stealth DCSync, an autopsy: no flag combination got me usable secrets without Get-Changes-All

  Published date: 2 Aug, 2026

  13 min read

  I tested five MS-DRSR flag and EXOP manipulations meant to perform a DCSync without triggering the DS-Replication-Get-Changes-All GUID in Event 4662. Every variant that returned usable credential material also logged the GUID, identically on Server 2016 and Server 2025. One variant contradicts the MS-DRSR specification and I could not resolve it.

  • #active-directory
  • #red-team
  • #detection-engineering
  • #impacket