dcsync detection from dc event log — free browser tool | fatcousin

drop domain controller event log · detect drsuapi getncchanges replication abuse

input

drop dc security evtx csv

4662 DS-Replication-Get-Changes

Select file

flags non-DC accounts with replication rights · bulk GetNCChanges clusters · off-hours DCSync-style 4662 bursts

limits

heuristic screener · 4662 property parsing varies by export schema — GUID/name matching only · not definitive proof

status

>ready