AdminSDHolder Backdoor

Author: Elastic
Source: upstream

Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their Administrative Privileges.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts, `T1078.002` Valid Accounts: Domain Accounts
Persistence	`T1078` Valid Accounts, `T1078.002` Valid Accounts: Domain Accounts, `T1098` Account Manipulation
Privilege Escalation	`T1078` Valid Accounts, `T1078.002` Valid Accounts: Domain Accounts, `T1098` Account Manipulation
Defense Evasion	`T1078` Valid Accounts, `T1078.002` Valid Accounts: Domain Accounts

Event coverage

Provider	Event ID	Title
Security-Auditing	5136	A directory service object was modified.

Stages and Predicates

Stage 1: `kql:query`

winlog.event_data.ObjectDN:"CN=AdminSDHolder,CN=System*"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.