Windows Security Event 5136: msDS-KeyCredentialLink Shadow Credential Added to AD Object
Alerts on AD attribute changes adding to msDS-KeyCredentialLink via Windows Security EventID 5136, consistent with shadow credential additions.
- Product
- windows
- Service
- security
- Author
- Nasreddine Bencherchali (Nextron Systems), Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-10-17
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security audit events where the msDS-KeyCredentialLink attribute is modified, indicating a likely addition of shadow credentials to an Active Directory object. Such changes can enable persistence and credential access by introducing attacker-controlled key credentials. It relies on telemetry from Windows Security logs, specifically Event ID 5136 with the AttributeLDAPDisplayName set to msDS-KeyCredentialLink.
Reporting behind it
- elastic.cohttps://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html
- cyberstoph.orghttps://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
- twitter.comhttps://twitter.com/SBousseaden/status/1581300963650187264?
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security Event 5136: msDS-KeyCredentialLink Shadow Credential Added to AD Object"
id: 6a443209-60ab-4361-88cc-26dda516c560
status: test
description: This rule flags Windows Security audit events where the msDS-KeyCredentialLink attribute is modified, indicating a likely addition of shadow credentials to an Active Directory object. Such changes can enable persistence and credential access by introducing attacker-controlled key credentials. It relies on telemetry from Windows Security logs, specifically Event ID 5136 with the AttributeLDAPDisplayName set to msDS-KeyCredentialLink.
references:
- https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html
- https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
- https://twitter.com/SBousseaden/status/1581300963650187264?
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml
author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-10-17
tags:
- attack.persistence
- attack.credential-access
- attack.defense-impairment
- attack.t1556
logsource:
product: windows
service: security
definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
selection:
EventID: 5136
AttributeLDAPDisplayName: msDS-KeyCredentialLink
condition: selection
falsepositives:
- Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions. (From elastic FP section)
level: high
license: DRL-1.1
related:
- id: f598ea0c-c25a-4f72-a219-50c44411c791
type: derived