Obsidian Sandstorm DCSync from Non-DC Correlated with Lateral Movement

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•4

Detects a sequence of events where a user performs a network logon (Event ID 4624, Logon Type 3) followed by a successful Directory Replication Service (DRS) request (Event ID 4662, Access Mask 0x100) on a Domain Controller within a one-hour window. This pattern is indicative of potential lateral movement followed by credential dumping via DCSync, often associated with tools like Mimikatz.