Domain-wide policy attribute or delegation ACL changed on the domain object

Siemphony@siemphonymediumT1484unverified

AN0755 describes GPO edits, trust edits, delegation-permission changes and rogue domain controller registration together, but the first two already have dedicated rules in this corpus: T1484.001 watches Security 5136 for ObjectClass groupPolicyContainer, and T1484.002 watches the same event for ObjectClass trustedDomain. Repeating either here would be the same observable under the parent's ID for zero new coverage, so this rule takes the piece of AN0755 that belongs to neither child: attribute changes on the domain's own root object (ObjectClass domainDNS) and on Fine-Grained Password Policy objects (ObjectClass msDS-PasswordSettings), scoped to the attributes that carry actual domain-wide policy rather than every possible edit — domain password and lockout policy, msDS-PasswordSettings' own per-object equivalents, ms-DS-MachineAccountQuota, gPLink (which GPOs are linked to the domain root, as distinct from editing a GPO's own content), and nTSecurityDescriptor on the domain object itself, which is the delegation leg AN0755 names explicitly — granting DCSync-class replication rights is a domain-object ACL edit, not a GPO or trust edit, and is not covered by either sibling rule. Rogue domain controller registration (DCShadow) is not attempted: that observable is an nTDSDSA object *creation* under the Configuration partition, which is Security EventID 5137, not 5136 — 5137 is absent from every log source this brief lists, and treating 5136 as though it covered object creation as well as modification would misrepresent what the event records. MITRE's `UserContext` knob (flag unexpected accounts) and `TimeWindow` knob (correlate with logon or process activity) are not implemented — lib/sigma has no baseline and no cross-event join, so this fires on the attribute change alone regardless of who made it. Prerequisite: Security 5136 needs the *Audit Directory Service Changes* subcategory enabled on every domain controller, plus a SACL covering the domain's root object and the Password Settings Container — neither is on in a default install or the Microsoft/CIS baselines, so an empty result here means the sensor is blind, not that the domain is unchanged. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0270, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

SecurityEvent| where ((EventID == 5136 and (ObjectClass =~ "domainDNS" or ObjectClass =~ "msDS-PasswordSettings")) and (AttributeLDAPDisplayName =~ "gPLink" or AttributeLDAPDisplayName =~ "gPOptions" or AttributeLDAPDisplayName =~ "lockoutDuration" or AttributeLDAPDisplayName =~ "lockoutThreshold" or AttributeLDAPDisplayName =~ "lockoutObservationWindow" or AttributeLDAPDisplayName =~ "maxPwdAge" or AttributeLDAPDisplayName =~ "minPwdAge" or AttributeLDAPDisplayName =~ "minPwdLength" or AttributeLDAPDisplayName =~ "pwdHistoryLength" or AttributeLDAPDisplayName =~ "pwdProperties" or AttributeLDAPDisplayName =~ "ms-DS-MachineAccountQuota" or AttributeLDAPDisplayName =~ "nTSecurityDescriptor" or AttributeLDAPDisplayName =~ "msDS-PasswordSettingsPrecedence" or AttributeLDAPDisplayName =~ "msDS-LockoutDuration" or AttributeLDAPDisplayName =~ "msDS-LockoutObservationWindow" or AttributeLDAPDisplayName =~ "msDS-LockoutThreshold" or AttributeLDAPDisplayName =~ "msDS-MinimumPasswordLength" or AttributeLDAPDisplayName =~ "msDS-PasswordHistoryLength"))

Splunk · SPL

Run this as a search.

index=* ((EventID="5136" AND (ObjectClass="domainDNS" OR ObjectClass="msDS-PasswordSettings")) AND (AttributeLDAPDisplayName="gPLink" OR AttributeLDAPDisplayName="gPOptions" OR AttributeLDAPDisplayName="lockoutDuration" OR AttributeLDAPDisplayName="lockoutThreshold" OR AttributeLDAPDisplayName="lockoutObservationWindow" OR AttributeLDAPDisplayName="maxPwdAge" OR AttributeLDAPDisplayName="minPwdAge" OR AttributeLDAPDisplayName="minPwdLength" OR AttributeLDAPDisplayName="pwdHistoryLength" OR AttributeLDAPDisplayName="pwdProperties" OR AttributeLDAPDisplayName="ms-DS-MachineAccountQuota" OR AttributeLDAPDisplayName="nTSecurityDescriptor" OR AttributeLDAPDisplayName="msDS-PasswordSettingsPrecedence" OR AttributeLDAPDisplayName="msDS-LockoutDuration" OR AttributeLDAPDisplayName="msDS-LockoutObservationWindow" OR AttributeLDAPDisplayName="msDS-LockoutThreshold" OR AttributeLDAPDisplayName="msDS-MinimumPasswordLength" OR AttributeLDAPDisplayName="msDS-PasswordHistoryLength"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 5136 AND (TO_LOWER(ObjectClass) == "domaindns" OR TO_LOWER(ObjectClass) == "msds-passwordsettings")) AND (TO_LOWER(AttributeLDAPDisplayName) == "gplink" OR TO_LOWER(AttributeLDAPDisplayName) == "gpoptions" OR TO_LOWER(AttributeLDAPDisplayName) == "lockoutduration" OR TO_LOWER(AttributeLDAPDisplayName) == "lockoutthreshold" OR TO_LOWER(AttributeLDAPDisplayName) == "lockoutobservationwindow" OR TO_LOWER(AttributeLDAPDisplayName) == "maxpwdage" OR TO_LOWER(AttributeLDAPDisplayName) == "minpwdage" OR TO_LOWER(AttributeLDAPDisplayName) == "minpwdlength" OR TO_LOWER(AttributeLDAPDisplayName) == "pwdhistorylength" OR TO_LOWER(AttributeLDAPDisplayName) == "pwdproperties" OR TO_LOWER(AttributeLDAPDisplayName) == "ms-ds-machineaccountquota" OR TO_LOWER(AttributeLDAPDisplayName) == "ntsecuritydescriptor" OR TO_LOWER(AttributeLDAPDisplayName) == "msds-passwordsettingsprecedence" OR TO_LOWER(AttributeLDAPDisplayName) == "msds-lockoutduration" OR TO_LOWER(AttributeLDAPDisplayName) == "msds-lockoutobservationwindow" OR TO_LOWER(AttributeLDAPDisplayName) == "msds-lockoutthreshold" OR TO_LOWER(AttributeLDAPDisplayName) == "msds-minimumpasswordlength" OR TO_LOWER(AttributeLDAPDisplayName) == "msds-passwordhistorylength"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^5136$</field>    <field name="ObjectClass" type="pcre2">(?i)(^domainDNS$|^msDS-PasswordSettings$)</field>    <field name="AttributeLDAPDisplayName" type="pcre2">(?i)(^gPLink$|^gPOptions$|^lockoutDuration$|^lockoutThreshold$|^lockoutObservationWindow$|^maxPwdAge$|^minPwdAge$|^minPwdLength$|^pwdHistoryLength$|^pwdProperties$|^ms-DS-MachineAccountQuota$|^nTSecurityDescriptor$|^msDS-PasswordSettingsPrecedence$|^msDS-LockoutDuration$|^msDS-LockoutObservationWindow$|^msDS-LockoutThreshold$|^msDS-MinimumPasswordLength$|^msDS-PasswordHistoryLength$)</field>    <description>Domain-wide policy attribute or delegation ACL changed on the domain object</description>    <mitre>      <id>T1484</id>    </mitre>  </rule></group>

At a glance

Logsource: security / windows
Level: medium
Category: directory_object_tampering
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1279dc3a-e1b4-4a37-bb4a-9e4cae8fe3d2

ATT&CKT1484

T1484Domain or Tenant Policy Modification

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondirectory object tampering

directory object tamperingAI draft — unreviewed

01 · What this rule detects

Domain or Tenant Policy Modification (T1484) — an adversary alters domain-wide settings to weaken defenses or grant themselves standing access. MITRE's AN0755 bundles GPO edits, trust edits, delegation-permission changes, and rogue domain-controller registration together, but GPO edits already have a dedicated rule at T1484.001 (Security 5136, ObjectClass: groupPolicyContainer). This rule takes the remaining piece that belongs to neither sibling: attribute changes on the domain's own root object and on Fine-Grained Password Policy objects, including the delegation-ACL leg AN0755 names explicitly.

02 · Telemetry you need

Windows Security EventID 5136, which requires the Audit Directory Service Changes subcategory enabled on every domain controller, plus a SACL covering the domain's root object and the Password Settings Container. Neither is on by default or in the Microsoft/CIS baselines — without both, an empty result means the sensor is blind, not that the domain is unchanged.

03 · How the logic works

Two selections, joined with AND rather than the 1 of pattern used elsewhere in this corpus, because both conditions must hold for the event to be a relevant attribute write. selection_object requires EventID: 5136 with ObjectClass of domainDNS (the domain root object) or msDS-PasswordSettings (a Fine-Grained Password Policy object). selection_attribute requires AttributeLDAPDisplayName to be one of a scoped list: domain password/lockout policy fields (lockoutDuration, maxPwdAge, minPwdLength, and their msDS--prefixed FGPP equivalents), ms-DS-MachineAccountQuota, gPLink (which GPOs are linked at the domain root, distinct from editing a GPO's own content, which is T1484.001's territory), and nTSecurityDescriptor on the domain object — the delegation-ACL leg, since granting DCSync-class replication rights is an ACL edit on the domain object rather than a GPO or trust edit. Rogue domain-controller registration (DCShadow) is deliberately not attempted: that observable is an nTDSDSA object creation under the Configuration partition, which is Security EventID 5137 — absent from every log source this brief lists. Treating 5136 as if it also covered object creation would misrepresent what the event records. MITRE's UserContext and TimeWindow knobs (flag unexpected accounts, correlate with logon activity) are not implemented — lib/sigma has no baseline or cross-event join, so this fires on the attribute change alone regardless of who made it.

04 · Common false positives

Four sources are named. Administrators changing domain password or lockout policy as a deliberate hardening or compliance project rewrites exactly these attributes by design. Linking or unlinking an approved GPO at the domain root rewrites gPLink every time, regardless of whether the linked GPO is benign. Directory-tooling or migration projects — domain migration utilities, tiering/delegation remediation, identity governance platforms — rewrite the domain object's ACL to establish a new model, indistinguishable here from an attacker granting themselves replication rights. AD backup and disaster-recovery restores of the domain object or Password Settings Container replay these same writes. level: medium reflects that most of this list is routine in any actively managed AD estate.
A reviewer flagged that this rule's description originally claimed T1484.002 covers trust-relationship attributes via the same event — but no rule.yml or declined.json exists yet for T1484.002 anywhere in the corpus. Treat trust-attribute coverage (trustPartner, trustDirection, trustType, trustAttributes) as a real gap, not something handled elsewhere, until that sibling is authored.

05 · Detection maturity

tier_1: This rule has never been run against a log line. It sits at the lowest DeBMM maturity tier until it has been run against real Security-log data from a domain controller with the prerequisite auditing and SACL actually configured.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline your change-management calendar against gPLink and ACL writes specifically — those two attributes carry the highest legitimate-change volume and the highest attacker value simultaneously, so alert fatigue there is likely without a change-window allowlist.

Declared by the author

Administrators changing domain password or lockout policy through the Default Domain Policy or a Fine-Grained Password Policy as a deliberate hardening or compliance project, which rewrites exactly these attributes by design.
Linking or unlinking an approved GPO at the domain root as part of routine policy rollout, which rewrites gPLink on the domain object every time regardless of whether the linked GPO itself is benign.
Directory-tooling or migration projects (domain migration utilities, tiering/delegation-model remediation, identity governance platforms) that rewrite the domain object's ACL to establish a new delegation model, which is indistinguishable here from an attacker granting themselves replication rights.
AD backup and disaster-recovery operations — an authoritative or non-authoritative restore of the domain object or the Password Settings Container replays these same attribute writes.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1484, evaluated against their — events.

Share this rule

/u/siemphony/1279dc3a-e1b4-4a37-bb4a-9e4cae8fe3d2

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Domain-wide policy attribute or delegation ACL changed on the domain object

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it