Zeek smb.log DCSync-like traffic

Zeek script: event dce_rpc::log_dce_rpc (rec: dce_rpc::Info) { if (rec?$endpoint && rec$endpoint == "DRSUAPI") print fmt("%s %s %s", rec$id$orig_h, rec$operation, rec$id$resp_h); }

Zeek script that monitors DCE/RPC calls to the DRSUAPI endpoint, the network signature of DCSync and anomalous directory replication.

Deploy this script on your Zeek sensor when you want the network view of DCSync: the attack uses DRSUAPI (the directory replication protocol) over DCE/RPC, usually encapsulated in SMB. Zeek parses those calls into dce_rpc.log with the DRSUAPI endpoint and the specific operation (DsGetNCChanges is the one that replicates hashes). The script leaves you a custom log with source, operation, and destination — the basis for detecting which host requests replication without being a DC. It's the detection that works even if DC auditing is off and it's a favorite among blue teams that already have Zeek on the domain segment.

Don't use it as the only DCSync detection: legitimate DRSUAPI calls between DCs generate the same traffic — the script without filtering gives you constant background noise in domains with multiple DCs. You need exception logic: only sources that are not DCs and DsGetNCChanges operations towards the DC. Also don't use it if your sensor doesn't see the DC segment (replication traffic doesn't pass through the span): the log will be empty. And beware: modern attacks can go over RPC over direct TCP (not SMB) — make sure your Zeek parses dce_rpc over both transports.