AdminSDHolder Backdoor

 1[metadata]
 2creation_date = "2022/01/31"
 3integration = ["system", "windows"]
 4maturity = "production"
 5updated_date = "2024/10/28"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent
13backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the
14AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on
15the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their
16Administrative Privileges.
17"""
18from = "now-9m"
19index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
20language = "kuery"
21license = "Elastic License v2"
22name = "AdminSDHolder Backdoor"
23references = [
24    "https://adsecurity.org/?p=1906",
25    "https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory#adminsdholder",
26]
27risk_score = 73
28rule_id = "6e9130a5-9be6-48e5-943a-9628bfc74b18"
29severity = "high"
30tags = [
31    "Domain: Endpoint",
32    "OS: Windows",
33    "Use Case: Threat Detection",
34    "Tactic: Persistence",
35    "Use Case: Active Directory Monitoring",
36    "Data Source: Active Directory",
37    "Data Source: System",
38]
39timestamp_override = "event.ingested"
40type = "query"
41
42query = '''
43event.action:("Directory Service Changes" or "directory-service-object-modified") and event.code:5136 and
44  winlog.event_data.ObjectDN:CN=AdminSDHolder,CN=System*
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1078"
52name = "Valid Accounts"
53reference = "https://attack.mitre.org/techniques/T1078/"
54[[rule.threat.technique.subtechnique]]
55id = "T1078.002"
56name = "Domain Accounts"
57reference = "https://attack.mitre.org/techniques/T1078/002/"
58
59
60[[rule.threat.technique]]
61id = "T1098"
62name = "Account Manipulation"
63reference = "https://attack.mitre.org/techniques/T1098/"
64
65
66[rule.threat.tactic]
67id = "TA0003"
68name = "Persistence"
69reference = "https://attack.mitre.org/tactics/TA0003/"