Windows Security Event 5136 for Changes to Default Domain and Default Domain Controllers GPOs
Flags EventID 5136 modifications to Default Domain or Default Domain Controllers GPO containers in Windows AD.
- Product
- windows
- Service
- security
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-22
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Event ID 5136 events where the changed object is a groupPolicyContainer whose ObjectDN starts with the GUIDs for the Default Domain Policy or Default Domain Controllers Policy. Attackers may target these default GPOs to push malicious or weakening configurations across the domain. It relies on Windows Security auditing telemetry that records directory service changes along with the object class and distinguished name prefix.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
- adsecurity.orghttps://adsecurity.org/?p=3377
- pentestpartners.comhttps://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
- jgspiers.comhttps://jgspiers.com/audit-group-policy-changes/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_default_domain_gpo_modification.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Security Event 5136 for Changes to Default Domain and Default Domain Controllers GPOs
id: d6f9c237-20e9-40c0-a9c1-b5b61723debc
related:
- id: dcff7e85-d01f-4eb5-badd-84e2e6be8294
type: similar
- id: e5ac86dd-2da1-454b-be74-05d26c769d7d
type: derived
status: experimental
description: This rule flags Event ID 5136 events where the changed object is a groupPolicyContainer whose ObjectDN starts with the GUIDs for the Default Domain Policy or Default Domain Controllers Policy. Attackers may target these default GPOs to push malicious or weakening configurations across the domain. It relies on Windows Security auditing telemetry that records directory service changes along with the object class and distinguished name prefix.
references:
- https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
- https://adsecurity.org/?p=3377
- https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
- https://jgspiers.com/audit-group-policy-changes/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_default_domain_gpo_modification.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-22
tags:
- attack.privilege-escalation
- attack.defense-impairment
- attack.t1484.001
logsource:
product: windows
service: security
definition: |
Enable 'Audit Directory Service Changes' in the Default Domain Controllers Policy under:
Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success).
Additionally, proper SACL needs to be configured on the 'CN=Policies,CN=System,DC=<domain>,DC=<tld>' container in Active Directory to capture changes to Group Policy Objects.
detection:
selection:
EventID: 5136
ObjectClass: groupPolicyContainer
ObjectDN|startswith:
- CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM
- CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM
condition: selection
falsepositives:
- Legitimate modifications to Default Domain or Default Domain Controllers GPOs
level: medium
license: DRL-1.1