Domain-wide policy attribute or delegation ACL changed on the domain object

1title: Domain-wide policy attribute or delegation ACL changed on the domain object2id: 1279dc3a-e1b4-4a37-bb4a-9e4cae8fe3d23status: experimental4description: |5  AN0755 describes GPO edits, trust edits, delegation-permission changes and6  rogue domain controller registration together, but the first two already7  have dedicated rules in this corpus: T1484.001 watches Security 5136 for8  ObjectClass groupPolicyContainer, and T1484.002 watches the same event for9  ObjectClass trustedDomain. Repeating either here would be the same10  observable under the parent's ID for zero new coverage, so this rule takes11  the piece of AN0755 that belongs to neither child: attribute changes on the12  domain's own root object (ObjectClass domainDNS) and on Fine-Grained13  Password Policy objects (ObjectClass msDS-PasswordSettings), scoped to the14  attributes that carry actual domain-wide policy rather than every possible15  edit — domain password and lockout policy, msDS-PasswordSettings' own16  per-object equivalents, ms-DS-MachineAccountQuota, gPLink (which GPOs are17  linked to the domain root, as distinct from editing a GPO's own content),18  and nTSecurityDescriptor on the domain object itself, which is the delegation19  leg AN0755 names explicitly — granting DCSync-class replication rights is a20  domain-object ACL edit, not a GPO or trust edit, and is not covered by21  either sibling rule. Rogue domain controller registration (DCShadow) is not22  attempted: that observable is an nTDSDSA object *creation* under the23  Configuration partition, which is Security EventID 5137, not 5136 — 5137 is24  absent from every log source this brief lists, and treating 5136 as though25  it covered object creation as well as modification would misrepresent what26  the event records.27  MITRE's `UserContext` knob (flag unexpected accounts) and `TimeWindow` knob28  (correlate with logon or process activity) are not implemented — lib/sigma29  has no baseline and no cross-event join, so this fires on the attribute30  change alone regardless of who made it.31  Prerequisite: Security 5136 needs the *Audit Directory Service Changes*32  subcategory enabled on every domain controller, plus a SACL covering the33  domain's root object and the Password Settings Container — neither is on in34  a default install or the Microsoft/CIS baselines, so an empty result here35  means the sensor is blind, not that the domain is unchanged.36  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0270, not hand-written and not tested by its author. Any lab result is on this rule's own page.37references:38  - https://attack.mitre.org/techniques/T148439  - https://attack.mitre.org/detectionstrategies/DET027040author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)41date: 2026-08-1842tags:43  - attack.defense-evasion44  - attack.privilege-escalation45  - attack.t148446logsource:47  product: windows48  service: security49detection:50  selection_object:51    EventID: 513652    ObjectClass:53      - 'domainDNS'54      - 'msDS-PasswordSettings'55  selection_attribute:56    AttributeLDAPDisplayName:57      - 'gPLink'58      - 'gPOptions'59      - 'lockoutDuration'60      - 'lockoutThreshold'61      - 'lockoutObservationWindow'62      - 'maxPwdAge'63      - 'minPwdAge'64      - 'minPwdLength'65      - 'pwdHistoryLength'66      - 'pwdProperties'67      - 'ms-DS-MachineAccountQuota'68      - 'nTSecurityDescriptor'69      - 'msDS-PasswordSettingsPrecedence'70      - 'msDS-LockoutDuration'71      - 'msDS-LockoutObservationWindow'72      - 'msDS-LockoutThreshold'73      - 'msDS-MinimumPasswordLength'74      - 'msDS-PasswordHistoryLength'75  condition: selection_object and selection_attribute76falsepositives:77  - "Administrators changing domain password or lockout policy through the Default Domain Policy or a Fine-Grained Password Policy as a deliberate hardening or compliance project, which rewrites exactly these attributes by design."78  - "Linking or unlinking an approved GPO at the domain root as part of routine policy rollout, which rewrites gPLink on the domain object every time regardless of whether the linked GPO itself is benign."79  - "Directory-tooling or migration projects (domain migration utilities, tiering/delegation-model remediation, identity governance platforms) that rewrite the domain object's ACL to establish a new delegation model, which is indistinguishable here from an attacker granting themselves replication rights."80  - "AD backup and disaster-recovery operations — an authoritative or non-authoritative restore of the domain object or the Password Settings Container replays these same attribute writes."81level: medium