Detection rules › By event

Microsoft-Windows-Security-Auditing event 5136

44 detection rules reference this event. View event page.

Sigma (10)

Active Directory User Backdoors severity high T1098
Group Policy Abuse for Privilege Addition severity medium T1484.001
Persistence and Execution at Scale via GPO Scheduled Task severity high T1053.005
Possible DC Shadow Attack severity medium T1207
Possible Shadow Credentials Added severity high T1556
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation severity high T1557.003
Powerview Add-DomainObjectAcl DCSync AD Extend Right severity high T1098
Startup/Logon Script Added to Group Policy Object severity medium T1484.001, T1547
Suspicious LDAP-Attributes Used severity high T1001.003
Windows Default Domain GPO Modification severity medium T1484.001

Splunk (23)