win:security 5136
A directory service object was modified.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: DS Access > Audit Directory Service Changes
- Audit category
- DS Access
- Audit subcategory
- Audit Directory Service Changes
- Tier, host type
- Minimum
- Techniques
- 7
- Rules depending on it
- Splunk 25, Sigma 10, Elastic 11, Microsoft Sentinel 17
Why this tier
DISA STIG (dc); Microsoft audit baseline (dc); NSA
By role
| Role | Tier | Basis |
|---|---|---|
| Windows domain controller | Minimum | DISA STIG (dc); Microsoft audit baseline (dc); NSA |
Techniques it helps detect
Rules that depend on it
Splunk 25
- Windows AD AdminSDHolder ACL Modified
- Windows AD Computer SPN Modified By User Account
- Windows AD DCShadow Privileges ACL Addition
- Windows AD Dangerous Deny ACL Modification
- Windows AD Dangerous Group ACL Modification
- Windows AD Dangerous User ACL Modification
- Windows AD Domain Replication ACL Addition
- Windows AD Domain Root ACL Deletion
- Windows AD Domain Root ACL Modification
- Windows AD GPO Deleted
- Windows AD GPO Disabled
- Windows AD GPO New CSE Addition
- Windows AD Hidden OU Creation
- Windows AD Object Owner Updated
- Windows AD SID History Attribute Modified
- Windows AD SPN Unicode Collision Injection
- Windows AD Self DACL Assignment
- Windows AD ServicePrincipalName Added To Domain Account
- Windows AD Short Lived Domain Account ServicePrincipalName
- Windows AD Short Lived Domain Controller SPN Attribute
- Windows AD Suspicious Attribute Modification
- Windows Default Group Policy Object Modified
- Windows Group Policy Object Created
- Windows Kerberos Coercion via DNS
- Windows Short Lived DNS Record
Sigma 10
- Active Directory User Backdoors by @neu5ron
- Group Policy Abuse for Privilege Addition by Elastic, Josh Nickels, Marius Rothenbücher
- Persistence and Execution at Scale via GPO Scheduled Task by Samir Bousseaden
- Possible DC Shadow Attack by Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah
- Possible Shadow Credentials Added by Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
- Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation by Swachchhanda Shrawan Poudel (Nextron Systems)
- Powerview Add-DomainObjectAcl DCSync AD Extend Right by Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat
- Startup/Logon Script Added to Group Policy Object by Elastic, Josh Nickels, Marius Rothenbücher
- Suspicious LDAP-Attributes Used by xknow @xknow_infosec
- Windows Default Domain GPO Modification by Swachchhanda Shrawan Poudel (Nextron Systems)
Elastic 11
- Account Configured with Never-Expiring Password
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- Group Policy Abuse for Privilege Addition
- Modification of the msPKIAccountCredentials
- Potential Active Directory Replication Account Backdoor
- Potential Shadow Credentials added to AD Object
- Scheduled Task Execution at Scale via GPO
- Startup/Logon Script added to Group Policy Object
- User account exposed to Kerberoasting
Microsoft Sentinel 17
- AdminSDHolder Modifications
- Exchange OAB Virtual Directory Attribute Containing Potential Webshell
- PROD (TM001.1) - GROUP - Added to Group Outside the Object Tier Level
- PROD (TM004.1) - OBJECT - Enabled, Disabled, Unlocked, or Password Reset of a Tier Level Object
- PROD (TM005.1) - GPO - Linked, Unlinked, or Enforced at Tier Level OU
- PROD (TM006.1) - ACL - Modified at Tier Level OU
- PROD (TM008.1) - GPO - Linked, Unlinked, or Enforced at Root of Domain
- PROD (TM009.1) - ACL - Modified at Root of the Domain
- PROD (TM011.1) - LAPS - Tier Level Computer Object LAPS Password Expiration Time Set Manually
- PROD (TM012.1) - GPO - Enforced Outside of Tier Model
- PROD (TM013.1) - OU - Block Inheritance was Enabled on an OU
- PROD (TM014.1) - GPO - Linked, Unlinked, or Enforced at the AD Site Level
- PROD (TM015.1) - ACL - Modified at KRBTGT or AdminSDHolder Object Level
- PROD (TM016.1) - GROUP - Added to Well-Known or Tier Model Group
- PROD (TM017.1) - GROUP - Tier 0 Added to Allow RODC Password Replication Group
- Possible Resource-Based Constrained Delegation Abuse
- Service Principal Name (SPN) Assigned to User Account
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-DC-000260 (dc): Audit Directory Service Changes Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-DC-000260 (dc): Audit Directory Service Changes Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-DC-000260 (dc): Audit Directory Service Changes Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-DC-000270 (dc): Audit Directory Service Changes Failure |
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | DNS/Directory Services: Directory service modified |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: A directory service object was modified. |