Obsidian Sandstorm Privileged Account Manipulation via Password Reset and Group Addition

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects signs of persistence via account manipulation consistent with the Obsidian Sandstorm actor. The rule monitors for unauthorized password resets on administrative accounts (Event IDs 4723, 4724), the addition of users to highly privileged security groups (Event IDs 4728, 4732), and modifications to user account attributes (Event ID 4738) that indicate changes in account control flags.