In this attack, an attacker pretends to be a DC and uses the Directory Replication Service Remote Protocol in order to extract NTLM hashes of users in the domain. One of the accounts he can extract using this protocol is the KRBTGT account, allowing the attacker to create golden tickets and as a result, compromise the domain completely. To perform this attack, the attacker must have compromised an account with special rights allowing the domain replication. These permissions are granted by default to domain admins, administrators, enterprise admins and domain controllers groups. The Mimikatz command performing this attack is- lsadump::dcsync /domain:<domain name> /user:<domain user account>