AD AdminSDHolder Permission Modification for Privileged Persistence (T1484.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects changes to the attributes of the AdminSDHolder object in Active Directory. The AdminSDHolder object is a template used by the Active Directory security descriptor propagator (SDProp) to enforce permissions on protected administrative groups. Modification of this object is a highly suspicious activity that can be used to establish persistence or grant excessive privileges by poisoning the security descriptors of all protected objects within the domain.