Obsidian Sandstorm DCSync Attack via DS-Replication-Get-Changes-All (T1003.006)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) related to Directory Replication (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All GUIDs) originating from non-domain controller accounts. This identifies unauthorized attempts to replicate Active Directory password data.