impacket-secretsdump

impacket-secretsdump <d>/<u>:<p>@<dc> -just-dc-user krbtgt

Run secretsdump against the test DC to validate that DCSync detection (anomalous replication) works with the real attack.

Run it in the purple team lab when you want to validate DCSync detection: secretsdump with -just-dc-user krbtgt replicates the real attack (directory replication to steal the krbtgt hash) and the team verifies what was detected — Event 4662 (the replication access), SIEM rules, DC EDR. This is the definitive DCSync validation: the real attacker tool (the one used by documented groups) and measured detection. In purple teaming, DCSync validation is done with secretsdump against the test DC — the detection that withstands the real tool is the one that counts.

Do not run it outside the lab: DCSync is the attack that steals domain hashes — the isolated test DC is the place. Execution requires credentials with replication permissions (the lab ones); without them, secretsdump fails and the result is not interpretable. And note: DCSync detection is in 4662 (the replication GUID) and in DC rules — validation measures those layers; the 'detected' result requires directory audit enabled on the test DC (without audit, there is no event). Cleanup (the lab krbtgt credentials exposed in the exercise) — the lab is rebuilt if needed.