Obsidian Sandstorm DCSync Attack via DS-Replication from Non-DC Account

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects unauthorized access attempts to Active Directory Directory Replication Services using Event ID 4662. It specifically monitors for the access mask 0x100 (Control Access) against the Domain Replication Service GUIDs, which are often indicative of techniques like DCSync used to harvest credentials or replicate the NTDS.dit database.