AdminSDHolder ACL Modification - Active Directory Privileged Access Persistence
Detects modifications to the Active Directory AdminSDHolder object's DACL, which is a known technique for achieving persistence in an AD environment. The rule alerts when a user (that is not a service account) modifies this object, correlating it with membership in highly privileged groups.
Microsoft Sentinel (KQL)
