AD object attribute modified. ObjectDN, AttributeLDAPDisplayName, AttributeValue are key. Shows exactly what changed in AD.
AdminSDHolder modification (persistence via SDProp abuse). GPO hijacking. msDS-AllowedToDelegateTo changes (constrained delegation for persistence). userAccountControl changes (enabling DONT_REQUIRE_PREAUTH for AS-REP roasting). SPN additions to user accounts (Kerberoasting setup).
Alert: ObjectDN contains AdminSDHolder. Alert: AttributeLDAPDisplayName=msDS-AllowedToDelegateTo changed on user accounts. Alert: userAccountControl change adding DONT_REQUIRE_PREAUTH flag. Alert: gpLink changes on domain/OU objects.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Persistence | Account Manipulation (T1098) |
| Defense Evasion | Group Policy Modification (T1484.001) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Sensitive AD Object Modified
status: experimental
description: Modification to sensitive AD objects including AdminSDHolder or GPOs
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 5136
ObjectDN|contains:
- 'AdminSDHolder'
- 'CN=Policies,CN=System'
condition: selection
falsepositives:
- Legitimate admin GPO changes
level: high
tags:
- attack.persistence
- attack.t1098
SecurityEvent
| where EventID == 5136 // A directory service object was modified
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=5136
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A directory service object was modified — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
A directory service object was modified. AD object attribute modified. ObjectDN, AttributeLDAPDisplayName, AttributeValue are key. Shows exactly what changed in AD.
Event 5136 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).
Event 5136 is associated with: Account Manipulation (T1098), Group Policy Modification (T1484.001).
Alert: ObjectDN contains AdminSDHolder. Alert: AttributeLDAPDisplayName=msDS-AllowedToDelegateTo changed on user accounts. Alert: userAccountControl change adding DONT_REQUIRE_PREAUTH flag. Alert: gpLink changes on domain/OU objects.