Obsidian Sandstorm DCSync via DRSUAPI Replication Rights Abuse

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects DCSync attacks abusing the directory replication (DRSUAPI) interface by auditing Windows Security Event 4662. The rule monitors for access to directory replication extended rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) on the domainDNS object, specifically excluding machine accounts and built-in service accounts to reduce noise. This behavior is indicative of unauthorized credential harvesting from Active Directory.