Defender for Endpoint DCSync hunting

DeviceEvents | where ActionType == "DirectoryServiceReplicationRequest"

Defender for Endpoint advanced hunting query that detects DCSync by looking for directory replication requests.

Run it in Microsoft 365 Defender when you have MDE deployed on the DCs and want to detect DCSync without relying on directory auditing. The ActionType DirectoryServiceReplicationRequest in DeviceEvents covers replication calls (DRSUAPI) from endpoints: any replication request that doesn't come from a legitimate DC is DCSync. It's the modern detection that replaces 4662 queries when Directory Service Access auditing isn't enabled — the EDR telemetry sees the system call, not the DC log. Ideal for environments where MDE is already in place and fine-grained auditing is missing.

Don't use it if the DCs don't have MDE onboarded: without a sensor on the DC, the telemetry doesn't exist and the query returns empty. Coverage of this ActionType depends on the sensor version and MDE policy configuration — verify with a controlled test before relying on it. And watch out for false positives: legitimate DCs and backup solutions that replicate NTDS generate the same event; the query needs the process and account filter to keep only the anomalous ones (a non-system process requesting replication).