Possible Shadow Credentials Added to Active Directory Object

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•84

Detects the possible addition of shadow credentials to an Active Directory object by monitoring for Event ID 5136 (Directory Service Changes) where the 'msDS-KeyCredentialLink' attribute is modified. This attribute is used in shadow credential attacks to establish persistence and gain unauthorized access.