Threat actors can launch DCSync attacks using tools like Mimikatz or the Get-ADReplAccount cmdlet from DSInternals. These tools make this technique relatively simple for attackers once they have compromised an AD account with the necessary permissions.

Read full article on Help Net Security