MediumSplunk security content Mauricio Velazco +2

Windows AD AdminSDHolder ACL Modified

Description

The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment.

Detection logic

Detection requirements

Platform: IaaS Linux macOS Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source category: windows_event_log_security_5136

Known benign triggers

Adding new users or groups to the AdminSDHolder ACL is not usual. Filter as needed

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
adsecurity.org/?p=1906	Security research	2from 2 sources
lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory	Product documentation	15
learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory	Product documentation	2from 2 sources
learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136	Product documentation	6from 2 sources
learn.microsoft.com/en-us/windows/win32/secauthz/access-control-lists	Product documentation	Only this detection cites it
medium.com/@cryps1s/detecting-windows-endpoint-compromise-with-sacls-cd748e10950	Unclassified	Only this detection cites it
pentestlab.blog/2022/01/04/domain-persistence-adminsdholder/	Unclassified	Only this detection cites it
social.technet.microsoft.com/wiki/contents/articles/22331.adminsdholder-protected-groups-and-security-descriptor-propagator.aspx	Unclassified	Only this detection cites it

Detection rules

Windows AD AdminSDHolder ACL Modified

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules