Analytics BIOC Low
✕

Suspicious modification of the AdminSDHolder's ACL

A user modified the AdminSDHolder ACL, which may be an indication of a privilege escalation attack.

Module:
Identity Analytics
Data source:
Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Account Manipulation (T1098)
Attacker's goals:

Attackers attempt to obtain full control privileges and then move laterally.

Investigative actions:

Check if a new user was added to the AdminSDHolder object. Check if a suspicious user account was recently created. Check if a user was added to a privileged group (e.g. Domain Admins). Investigate any other potentially suspicious behavior from the compromised user. Search for actions that may trigger SDProp, such as modifying the registry or executing an LDAP query.

Test period:
N/A (single event)
Deduplication:
1 Day