Detection rules › By event

Microsoft-Windows-Security-Auditing Event ID 5136

60 detection rules reference this event. View event page.

Sigma (20)

Active Directory User Backdoors severity high T1098
AdminSDHolder permissions changed for persistence severity high T1546
Computer account manipulation for delegation (RBCD) severity high T1098
Computer account modifying Active Directory permissions severity high T1222, T1222.001
Computer account modifying Active Directory permissions (PrivExchange) severity high T1222, T1222.001
Extended rights backdoor obfuscation (via localizationDisplayId attribute) severity high T1564
Group Policy Abuse for Privilege Addition severity medium T1484, T1484.001
Permissions changed on a Group Policy (GPO) severity medium T1484, T1484.001
Persistence and Execution at Scale via GPO Scheduled Task severity high T1053, T1053.005
Possible DC Shadow Attack severity medium T1207
Possible Shadow Credentials Added severity high T1556
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation severity high T1557, T1557.003
Powerview Add-DomainObjectAcl DCSync AD Extend Right severity high T1098
Replication privileges granted to perform DCSync attack severity high T1222, T1222.001
Startup/Logon Script Added to Group Policy Object severity medium T1484, T1484.001, T1547
Suspicious LDAP-Attributes Used severity high T1001, T1001.003
Suspicious modification of a fake domain controller SPN (DCshadow) (Directory Services) severity high T1098
Suspicious modification of a sensitive Group Policy (GPO) severity medium T1484, T1484.001
Suspicious modification of a user account SPN to enable Kerberoast attack severity high T1098
Windows Default Domain GPO Modification severity medium T1484, T1484.001

Elastic (11)

Account Configured with Never-Expiring Password severity medium T1098
AdminSDHolder Backdoor severity high T1078, T1078.002, T1098
AdminSDHolder SDProp Exclusion Added severity high T1078, T1078.002, T1098, T1484
Delegated Managed Service Account Modification by an Unusual User severity high T1078, T1078.002, T1098
Group Policy Abuse for Privilege Addition severity high T1484, T1484.001
Modification of the msPKIAccountCredentials severity medium T1068, T1098
Potential Active Directory Replication Account Backdoor severity medium T1003, T1003.006, T1098
Potential Shadow Credentials added to AD Object severity high T1098, T1556
Scheduled Task Execution at Scale via GPO severity medium T1053, T1053.005, T1484, T1484.001, T1570
Startup/Logon Script added to Group Policy Object severity medium T1037, T1484, T1484.001, T1547
User account exposed to Kerberoasting severity medium T1098, T1558, T1558.003

Splunk (24)

Modify Group Policy (Windows Event Log) T1484, T1484.001
Windows AD AdminSDHolder ACL Modified severity medium T1546
Windows AD Dangerous Deny ACL Modification severity medium T1222, T1222.001, T1484
Windows AD Dangerous Group ACL Modification severity medium T1222, T1222.001, T1484
Windows AD Dangerous User ACL Modification severity medium T1222, T1222.001, T1484
Windows AD DCShadow Privileges ACL Addition severity medium T1207, T1222, T1222.001, T1484
Windows AD Domain Replication ACL Addition severity medium T1484
Windows AD Domain Root ACL Deletion severity medium T1222, T1222.001, T1484
Windows AD Domain Root ACL Modification severity medium T1222, T1222.001, T1484
Windows AD GPO Deleted severity medium T1484, T1484.001, T1685
Windows AD GPO Disabled severity medium T1484, T1484.001, T1685
Windows AD GPO New CSE Addition severity medium T1222, T1222.001, T1484, T1484.001
Windows AD Hidden OU Creation severity medium T1222, T1222.001, T1484
Windows AD Object Owner Updated severity medium T1222, T1222.001, T1484
Windows AD Self DACL Assignment severity medium T1098, T1484
Windows AD ServicePrincipalName Added To Domain Account severity medium T1098
Windows AD Short Lived Domain Account ServicePrincipalName severity medium T1098
Windows AD Short Lived Domain Controller SPN Attribute severity medium T1207
Windows AD SID History Attribute Modified severity medium T1134, T1134.005
Windows AD Suspicious Attribute Modification severity medium T1222, T1222.001, T1550
Windows Default Group Policy Object Modified severity medium T1484, T1484.001
Windows Group Policy Object Created severity medium T1078, T1078.002, T1484, T1484.001
Windows Kerberos Coercion via DNS severity medium T1071, T1071.004, T1187, T1557, T1557.001
Windows Short Lived DNS Record severity medium T1071, T1071.004, T1187, T1557, T1557.001

Kusto (5)

AdminSDHolder Modifications severity high T1078
Exchange OAB Virtual Directory Attribute Containing Potential Webshell severity high T1190
Possible Resource-Based Constrained Delegation Abuse severity medium T1134
Service Principal Name (SPN) Assigned to User Account severity medium T1134
Shadow Credentials Added to Account T1098, T1484

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-Security-Auditing Event ID 5136

Sigma (20)

Elastic (11)

Splunk (24)

Kusto (5)

Keyboard shortcuts

Search operators