DC microgrids often present a hierarchical control architecture, requiring integration of communication layers. This leads to the possibility of malicious attackers disrupting the overall system. Motivated by this application, in this article, we present a distributed monitoring scheme to provide attack-detection capabilities for linear large-scale systems. The proposed architecture relies on a Luenberger observer together with a bank of unknown-input observers at each subsystem, providing attack detection capabilities. We describe the architecture and analyze conditions under which attacks are guaranteed to be detected, and, conversely, when they are stealthy. Our analysis shows that some classes of attacks cannot be detected using either module independently; rather, by exploiting both modules simultaneously, we are able to improve the detection properties of the diagnostic tool as a whole. Theoretical results are backed up by simulations, where our method is applied to a realistic model of a low-voltage DC microgrid under attack.