Windows Security Event 5136: Default Domain GPO container modification

title: "Windows Security Event 5136: Default Domain GPO container modification"
id: d6f9c237-20e9-40c0-a9c1-b5b61723debc
related:
  - id: dcff7e85-d01f-4eb5-badd-84e2e6be8294
    type: similar
  - id: e5ac86dd-2da1-454b-be74-05d26c769d7d
    type: derived
status: experimental
description: This rule identifies changes to Group Policy Object containers for the Default Domain or Default Domain Controllers by matching Windows Security Event ID 5136 with specific groupPolicyContainer ObjectDNs. Modifying these default GPOs can let an attacker alter domain-wide security settings and deployment behavior. It relies on security audit telemetry from Active Directory change events that include the object class and the modified object distinguished name.
references:
  - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
  - https://adsecurity.org/?p=3377
  - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
  - https://jgspiers.com/audit-group-policy-changes/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_default_domain_gpo_modification.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-22
tags:
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1484.001
logsource:
  product: windows
  service: security
  definition: |
    Enable 'Audit Directory Service Changes' in the Default Domain Controllers Policy under:
    Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success).
    Additionally, proper SACL needs to be configured on the 'CN=Policies,CN=System,DC=<domain>,DC=<tld>' container in Active Directory to capture changes to Group Policy Objects.
detection:
  selection:
    EventID: 5136
    ObjectClass: groupPolicyContainer
    ObjectDN|startswith:
      - CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM
      - CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM
  condition: selection
falsepositives:
  - Legitimate modifications to Default Domain or Default Domain Controllers GPOs
level: medium
license: DRL-1.1