---
id: 5822
title: "DCSync Attack Explained"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/dcsync-attack/"
published_at: "2024-10-09T23:00:45Z"
tags: ["active-directory", "credential-theft", "detection", "domain-controller", "dcsync", "purple-knight", "replication"]
phying_url: "https://phying.com/item/5822"
lang: en
---

# DCSync Attack Explained

## Summary

DCSync attackers impersonate a domain controller to pull password hashes from a DC via the DRS protocol—no code runs on it, and audit trails are bypassed. Covers Purple Knight detection and defense.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2024-10-09T23:00:45Z
- **Original:** https://www.semperis.com/blog/dcsync-attack/
- **Phying News:** https://phying.com/item/5822