Windows Active Directory Group Policy Object Modified

Lucas Pinho@lucaslapinho

•updated Aug 17, 2026•0•0•1

Detects modifications to Active Directory objects of the class 'groupPolicyContainer' by monitoring Windows Security Event ID 5136. Unauthorized or unexpected GPO modifications can be used by attackers to weaken security controls, establish persistence, or facilitate privilege escalation across a domain.