The Tale of the Lost, but not Forgotten, Undocumented NetSync: Part 1

This blog post analyzes NetSync, a lesser-documented Mimikatz lsadump capability that uses MS-NRPC (Netlogon) to impersonate machine accounts and retrieve NTLM machine-account hashes (including DC$), explains how it differs from DCSync, breaks down the protocol interactions, lists required inputs and demonstrates practical attack paths (spooler RPC coercion and DAMP-based remote registry access), with defensive detection and mitigation to be covered in a subsequent Part 2.