AdminSDHolder Backdoor
Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their Administrative Privileges.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2022/01/31"
3integration = ["system", "windows"]
4maturity = "production"
5updated_date = "2024/10/28"
6min_stack_version = "8.14.0"
7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
8
9[rule]
10author = ["Elastic"]
11description = """
12Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent
13backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the
14AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on
15the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their
16Administrative Privileges.
17"""
18from = "now-9m"
19index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
20language = "kuery"
21license = "Elastic License v2"
22name = "AdminSDHolder Backdoor"
23references = [
24 "https://adsecurity.org/?p=1906",
25 "https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory#adminsdholder",
26]
27risk_score = 73
28rule_id = "6e9130a5-9be6-48e5-943a-9628bfc74b18"
29severity = "high"
30tags = [
31 "Domain: Endpoint",
32 "OS: Windows",
33 "Use Case: Threat Detection",
34 "Tactic: Persistence",
35 "Use Case: Active Directory Monitoring",
36 "Data Source: Active Directory",
37 "Data Source: System",
38]
39timestamp_override = "event.ingested"
40type = "query"
41
42query = '''
43event.action:("Directory Service Changes" or "directory-service-object-modified") and event.code:5136 and
44 winlog.event_data.ObjectDN:CN=AdminSDHolder,CN=System*
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1078"
52name = "Valid Accounts"
53reference = "https://attack.mitre.org/techniques/T1078/"
54[[rule.threat.technique.subtechnique]]
55id = "T1078.002"
56name = "Domain Accounts"
57reference = "https://attack.mitre.org/techniques/T1078/002/"
58
59
60[[rule.threat.technique]]
61id = "T1098"
62name = "Account Manipulation"
63reference = "https://attack.mitre.org/techniques/T1098/"
64
65
66[rule.threat.tactic]
67id = "TA0003"
68name = "Persistence"
69reference = "https://attack.mitre.org/tactics/TA0003/"
References
Related rules
- Account Configured with Never-Expiring Password
- Sensitive Privilege SeEnableDelegationPrivilege assigned to a User
- Active Directory Group Modification by SYSTEM
- AdminSDHolder SDProp Exclusion Added
- KRBTGT Delegation Backdoor