[metadata]
creation_date = "2022/01/31"
integration = ["system", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/10/09"

[rule]
author = ["Elastic"]
description = """
Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent
backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the
AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on
the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their
Administrative Privileges.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
language = "kuery"
license = "Elastic License v2"
name = "AdminSDHolder Backdoor"
references = [
    "https://adsecurity.org/?p=1906",
    "https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory#adminsdholder",
]
risk_score = 73
rule_id = "6e9130a5-9be6-48e5-943a-9628bfc74b18"
severity = "high"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.action:"Directory Service Changes" and event.code:5136 and
  winlog.event_data.ObjectDN:CN=AdminSDHolder,CN=System*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.002"
name = "Domain Accounts"
reference = "https://attack.mitre.org/techniques/T1078/002/"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"