# Conducting Domain Persistence With Dcsync

Perform DCSync attacks to replicate Active Directory credentials and establish domain...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill conducting-domain-persistence-with-dcsync -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill conducting-domain-persistence-with-dcsync -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill conducting-domain-persistence-with-dcsync -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill conducting-domain-persistence-with-dcsync -g -a gemini-cli -y`

## Description

Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Conducting Domain Persistence with DCSync


> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

## Overview

DCSync is an attack technique that abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller and request password data from the target DC. The attack was introduced by Benjamin Delpy (Mimikatz author) and Vincent Le Toux, leveraging the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights. Any principal (user or computer) with these rights can replicate password hashes for any account in the domain, including the KRBTGT account. With the KRBTGT hash, attackers can forge Golden Tickets for indefinite domain persistence. DCSync is categorized as MITRE ATT&CK T1003.006 and is a critical post-exploitation technique used by APT groups including APT28 (Fancy Bear), APT29 (Cozy Bear), and FIN6.


## When to Use

- When conducting security assessments that involve conducting domain persistence with dcsync
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing

## Prerequisites

- Familiarity with red teaming concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities

## Objectives

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/conducting-domain-persistence-with-dcsync/SKILL.md