Windows Security 5136: Modify AD ACL for DCSync Extended Right via ntSecurityDescriptor

Flags directory ACL changes (EventID 5136) that include DCSync extended right GUIDs in ntSecurityDescriptor for DNS objects.

FreeReviewedSigma · High · v2

Product: windows
Service: security
Author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat (SigmaHQ), DRL 1.1
Published: 2019-04-03
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1098Account Manipulation
Priv Esc
- T1098Account Manipulation
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Security event 5136 where an Active Directory object’s ntSecurityDescriptor is modified to include GUIDs associated with the DCSync extended right. Granting this right can enable an attacker to establish replication-like directory read capabilities, which can facilitate credential theft. It relies on Windows Security auditing for Directory Service changes and parses the AttributeLDAPDisplayName and AttributeValue contents within event 5136, scoped to DNS-related object classes.

Reporting behind it

Related detections9 linkedT1098 — drag to rearrange

Malicious Cluster-Admin Role Binding Creation (via audit)

Malicious User Password Change Using Current Hash Password - ChangeNTLM - Mimikatz (via security)

Suspicious Account Password Set to Never Expire. (via security)

Malicious Modification of a Computer Account SPN (via security)

Suspicious Massive Group Membership Changes (via security)

Malicious High Risk Active Directory Group Membership Change (via security)

Malicious Account Marked as Sensitive and Cannot Be Delegated Had Its Protection Removed (via security)

Malicious Host Constrained Delegation Settings Changed for Potential Abuse (Rubeus) - Kerberos Only (via security)

Malicious Host Set with Unconstrained Delegation (via security)

Windows Security 5136: Modify AD ACL for DCSync Extended Right via ntSecurityDescriptor

Pivot detection · T1098 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-detects-dcsync-extended-right-ace-changes-eventid-5136-via-powe-2c99737c

title: "Windows Security 5136: Modify AD ACL for DCSync Extended Right via ntSecurityDescriptor"
id: f97a6de1-56fa-40fc-9442-f971fe610e14
status: test
description: This rule identifies Security event 5136 where an Active Directory object’s ntSecurityDescriptor is modified to include GUIDs associated with the DCSync extended right. Granting this right can enable an attacker to establish replication-like directory read capabilities, which can facilitate credential theft. It relies on Windows Security auditing for Directory Service changes and parses the AttributeLDAPDisplayName and AttributeValue contents within event 5136, scoped to DNS-related object classes.
references:
  - https://twitter.com/menasec1/status/1111556090137903104
  - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml
author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat, Huntrule Team
date: 2019-04-03
modified: 2022-08-16
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: windows
  service: security
  definition: 'Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)'
detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: ntSecurityDescriptor
    AttributeValue|contains:
      - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
      - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
      - 89e95b76-444d-4c62-991a-0facbeda640c
  filter_main_dns_object_class:
    ObjectClass:
      - dnsNode
      - dnsZoneScope
      - dnsZone
  condition: selection and not 1 of filter_main_*
falsepositives:
  - New Domain Controller computer account, check user SIDs within the value attribute of event 5136 and verify if it's a regular user or DC computer account.
level: high
license: DRL-1.1
related:
  - id: 2c99737c-585d-4431-b61a-c911d86ff32f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL