Event ID 5136: A directory service object was modified
Written on domain controllers when an Active Directory object's attribute changes, with the old and new value.
- Log
- Security
- Category
- Active Directory
Why it matters
- Covers Group Policy changes, delegation changes, and permission changes on sensitive objects such as AdminSDHolder.
- Changes to Group Policy objects can push malware to every machine they apply to.
What to check
Check Object DN, Attribute LDAP Display Name, the value and the account making the change.
How to turn it on
Advanced Audit Policy on domain controllers: DS Access > Audit Directory Service Changes.
MITRE ATT&CK
- T1484.001 Group Policy Modification
- T1098 Account Manipulation