Windows Security 5136: Modify AD ACL for DCSync Extended Right via ntSecurityDescriptor
Flags directory ACL changes (EventID 5136) that include DCSync extended right GUIDs in ntSecurityDescriptor for DNS objects.
- Product
- windows
- Service
- security
- Author
- Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat (SigmaHQ), DRL 1.1
- Published
- 2019-04-03
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Security event 5136 where an Active Directory object’s ntSecurityDescriptor is modified to include GUIDs associated with the DCSync extended right. Granting this right can enable an attacker to establish replication-like directory read capabilities, which can facilitate credential theft. It relies on Windows Security auditing for Directory Service changes and parses the AttributeLDAPDisplayName and AttributeValue contents within event 5136, scoped to DNS-related object classes.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security 5136: Modify AD ACL for DCSync Extended Right via ntSecurityDescriptor"
id: f97a6de1-56fa-40fc-9442-f971fe610e14
status: test
description: This rule identifies Security event 5136 where an Active Directory object’s ntSecurityDescriptor is modified to include GUIDs associated with the DCSync extended right. Granting this right can enable an attacker to establish replication-like directory read capabilities, which can facilitate credential theft. It relies on Windows Security auditing for Directory Service changes and parses the AttributeLDAPDisplayName and AttributeValue contents within event 5136, scoped to DNS-related object classes.
references:
- https://twitter.com/menasec1/status/1111556090137903104
- https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml
author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat, Huntrule Team
date: 2019-04-03
modified: 2022-08-16
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1098
logsource:
product: windows
service: security
definition: 'Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)'
detection:
selection:
EventID: 5136
AttributeLDAPDisplayName: ntSecurityDescriptor
AttributeValue|contains:
- 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
- 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
- 89e95b76-444d-4c62-991a-0facbeda640c
filter_main_dns_object_class:
ObjectClass:
- dnsNode
- dnsZoneScope
- dnsZone
condition: selection and not 1 of filter_main_*
falsepositives:
- New Domain Controller computer account, check user SIDs within the value attribute of event 5136 and verify if it's a regular user or DC computer account.
level: high
license: DRL-1.1
related:
- id: 2c99737c-585d-4431-b61a-c911d86ff32f
type: derived