Obsidian Sandstorm: Account Manipulation and Privilege Abuse After Lateral Movement

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•3

Detects instances where a user account is created or modified (e.g., added to a local admin group) shortly after a network logon event (Logon Type 3 or 10). This behavioral correlation is highly indicative of lateral movement followed by local privilege escalation or persistence establishment.