Hunting With Active Directory Replication Metadata

Published

2017-09-06 07:00

Collected

2026-10-17 11:56

---
id: 9913
title: "Hunting With Active Directory Replication Metadata"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2017/09/06/hunting-with-active-directory-replication-metadata/"
published_at: "2017-09-06T07:00:55Z"
phying_url: "https://phying.com/item/9913"
lang: en
---

# Hunting With Active Directory Replication Metadata

## Summary

With the recent release of BloodHound’s ACL Attack Path Update as well as the work on Active Directory DACL backdooring by @_wald0 and myself, I started to investigate ACL-based attack paths from a defensive perspective. Sean Metcalf has done some great work concerning Active Directory threat hunting (see his 2017 BSides Charm “Detecting the Elusive: Active Directory Threat Hunting” presentation) and I wanted […]

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2017-09-06T07:00:55Z
- **Original:** https://specterops.io/blog/2017/09/06/hunting-with-active-directory-replication-metadata/
- **Phying News:** https://phying.com/item/9913