AdminSDHolder Backdoor

 1[metadata]
 2creation_date = "2022/01/31"
 3integration = ["system", "windows"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/10/09"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent
13backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the
14AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on
15the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their
16Administrative Privileges.
17"""
18from = "now-9m"
19index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
20language = "kuery"
21license = "Elastic License v2"
22name = "AdminSDHolder Backdoor"
23references = [
24    "https://adsecurity.org/?p=1906",
25    "https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory#adminsdholder",
26]
27risk_score = 73
28rule_id = "6e9130a5-9be6-48e5-943a-9628bfc74b18"
29severity = "high"
30tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"]
31timestamp_override = "event.ingested"
32type = "query"
33
34query = '''
35event.action:"Directory Service Changes" and event.code:5136 and
36  winlog.event_data.ObjectDN:CN=AdminSDHolder,CN=System*
37'''
38
39
40[[rule.threat]]
41framework = "MITRE ATT&CK"
42[[rule.threat.technique]]
43id = "T1078"
44name = "Valid Accounts"
45reference = "https://attack.mitre.org/techniques/T1078/"
46
47[[rule.threat.technique.subtechnique]]
48id = "T1078.002"
49name = "Domain Accounts"
50reference = "https://attack.mitre.org/techniques/T1078/002/"
51
52[[rule.threat.technique]]
53id = "T1098"
54name = "Account Manipulation"
55reference = "https://attack.mitre.org/techniques/T1098/"
56
57[rule.threat.tactic]
58id = "TA0003"
59name = "Persistence"
60reference = "https://attack.mitre.org/tactics/TA0003/"