← Library
kqlElastic-2.0from elastic/detection-rules

AdminSDHolder Backdoor

Quality
92
FP risk
—
Forks
0
Views
0
ATT&CK techniques
T1078T1078.002T1098
Rule sourcerules/windows/persistence_ad_adminsdholder.toml
event.code:5136 and host.os.type:"windows" and winlog.event_data.ObjectDN:CN=AdminSDHolder,CN=System*