Data Source: Windows Event Log Security 5136

Created: 2024-05-22

Last Updated: 2026-10-14

ID: 7ba3737e-231e-455d-824e-cd077749f835

Author: Patrick Bareiss, Splunk

Description

Logs modifications made to an Active Directory object, including details about the object name, type, and the changes applied.

Details

Property	Value
Source	`XmlWinEventLog:Security`
Sourcetype	`XmlWinEventLog`
Separator	EventCode

Name ▲▼	Technique ▲▼	Type ▲▼
Windows AD DCShadow Privileges ACL Addition	Rogue Domain Controller, Windows Permissions, Domain or Tenant Policy Modification	TTP
Windows AD Short Lived Domain Account ServicePrincipalName	Account Manipulation	TTP
Windows AD GPO Disabled	Group Policy Modification, Disable or Modify Tools	TTP
Windows AD Dangerous User ACL Modification	Windows Permissions, Domain or Tenant Policy Modification	TTP
Windows AD SPN Unicode Collision Injection	Downgrade Attack	TTP
Windows AD Dangerous Group ACL Modification	Windows Permissions, Domain or Tenant Policy Modification	TTP
Windows AD Object Owner Updated	Windows Permissions, Domain or Tenant Policy Modification	TTP
Windows AD GPO New CSE Addition	Windows Permissions, Group Policy Modification	TTP
Windows AD Suspicious Attribute Modification	Windows Permissions, Use Alternate Authentication Material	TTP
Windows AD Short Lived Domain Controller SPN Attribute	Rogue Domain Controller	TTP
Windows AD Computer SPN Modified By User Account	Kerberoasting, Downgrade Attack	Anomaly
Windows AD Self DACL Assignment	Account Manipulation, Domain or Tenant Policy Modification	TTP
Windows AD Domain Replication ACL Addition	Domain or Tenant Policy Modification	TTP
Windows Kerberos Coercion via DNS	DNS, Forced Authentication, Name Resolution Poisoning and SMB Relay	TTP
Windows AD Domain Root ACL Modification	Windows Permissions, Domain or Tenant Policy Modification	TTP
Windows Default Group Policy Object Modified	Group Policy Modification	TTP
Windows AD ServicePrincipalName Added To Domain Account	Account Manipulation	TTP
Windows Short Lived DNS Record	DNS, Forced Authentication, Name Resolution Poisoning and SMB Relay	TTP
Windows AD SID History Attribute Modified	SID-History Injection	TTP
Windows AD Dangerous Deny ACL Modification	Windows Permissions, Domain or Tenant Policy Modification	TTP
Windows AD GPO Deleted	Group Policy Modification, Disable or Modify Tools	TTP
Windows Group Policy Object Created	Domain Accounts, Group Policy Modification	TTP
Windows AD Hidden OU Creation	Windows Permissions, Domain or Tenant Policy Modification	TTP
Windows AD AdminSDHolder ACL Modified	Event Triggered Execution	TTP
Windows AD Domain Root ACL Deletion	Windows Permissions, Domain or Tenant Policy Modification	TTP

Supported Apps

Splunk Add-on for Microsoft Windows (version 11.0.3)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">ActivityID</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">AppCorrelationID</span>
  
  <span class="pill kill-chain">AttributeLDAPDisplayName</span>
  
  <span class="pill kill-chain">AttributeSyntaxOID</span>
  
  <span class="pill kill-chain">AttributeValue</span>
  
  <span class="pill kill-chain">Caller_Domain</span>
  
  <span class="pill kill-chain">Caller_User_Name</span>
  
  <span class="pill kill-chain">Channel</span>
  
  <span class="pill kill-chain">Computer</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_nt_domain</span>
  
  <span class="pill kill-chain">DSName</span>
  
  <span class="pill kill-chain">DSType</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">dvc_nt_host</span>
  
  <span class="pill kill-chain">Error_Code</span>
  
  <span class="pill kill-chain">event_id</span>
  
  <span class="pill kill-chain">event_time</span>
  
  <span class="pill kill-chain">EventCode</span>
  
  <span class="pill kill-chain">EventData_Xml</span>
  
  <span class="pill kill-chain">EventID</span>
  
  <span class="pill kill-chain">EventRecordID</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">Guid</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">Logon_ID</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">name</span>
  
  <span class="pill kill-chain">ObjectClass</span>
  
  <span class="pill kill-chain">ObjectDN</span>
  
  <span class="pill kill-chain">ObjectGUID</span>
  
  <span class="pill kill-chain">Opcode</span>
  
  <span class="pill kill-chain">OpCorrelationID</span>
  
  <span class="pill kill-chain">OperationType</span>
  
  <span class="pill kill-chain">ProcessID</span>
  
  <span class="pill kill-chain">product</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">RecordNumber</span>
  
  <span class="pill kill-chain">session_id</span>
  
  <span class="pill kill-chain">severity</span>
  
  <span class="pill kill-chain">severity_id</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src_nt_domain</span>
  
  <span class="pill kill-chain">src_subject_user_id</span>
  
  <span class="pill kill-chain">src_user</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">subject</span>
  
  <span class="pill kill-chain">SubjectDomainName</span>
  
  <span class="pill kill-chain">SubjectLogonId</span>
  
  <span class="pill kill-chain">SubjectUserName</span>
  
  <span class="pill kill-chain">SubjectUserSid</span>
  
  <span class="pill kill-chain">System_Props_Xml</span>
  
  <span class="pill kill-chain">SystemTime</span>
  
  <span class="pill kill-chain">ta_windows_action</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::action</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">Task</span>
  
  <span class="pill kill-chain">TaskCategory</span>
  
  <span class="pill kill-chain">ThreadID</span>
  
  <span class="pill kill-chain">timestamp</span>
  
  <span class="pill kill-chain">vendor</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
  <span class="pill kill-chain">Version</span>
  
</div>

Example Log

1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>5136</EventID><Version>0</Version><Level>0</Level><Task>14081</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2023-11-24T06:15:02.575497000Z'/><EventRecordID>8462997</EventRecordID><Correlation ActivityID='{AE855537-1368-0001-4555-85AE6813DA01}'/><Execution ProcessID='608' ThreadID='5984'/><Channel>Security</Channel><Computer>ar-win-dc.attackrange.local</Computer><Security/></System><EventData><Data Name='OpCorrelationID'>{DAA78BEA-1686-4F99-9F07-6E113CDACAED}</Data><Data Name='AppCorrelationID'>-</Data><Data Name='SubjectUserSid'>ATTACKRANGE\Administrator</Data><Data Name='SubjectUserName'>Administrator</Data><Data Name='SubjectDomainName'>ATTACKRANGE</Data><Data Name='SubjectLogonId'>0xd16f3</Data><Data Name='DSName'>attackrange.local</Data><Data Name='DSType'>%%14676</Data><Data Name='ObjectDN'>cn={F12AD28C-02E9-42B4-A0A7-6E89C066B65F},cn=policies,cn=system,DC=attackrange,DC=local</Data><Data Name='ObjectGUID'>{E65A4255-C048-4375-A295-82FD8A53AC59}</Data><Data Name='ObjectClass'>groupPolicyContainer</Data><Data Name='AttributeLDAPDisplayName'>flags</Data><Data Name='AttributeSyntaxOID'>2.5.5.9</Data><Data Name='AttributeValue'>3</Data><Data Name='OperationType'>%%14674</Data></EventData></Event>

Required Output Fields

dest

Source: GitHub | Version: 5