AD DCSync Attack Detected
Detects specific object access (EventID 4662) targeting sensitive Active Directory objects, including Domain Admin, Enterprise Admin, or other high-value security principal containers. These GUIDs are associated with common Active Directory enumeration or exploitation techniques used to identify critical infrastructure or perform reconnaissance.
Microsoft Sentinel (KQL)
