AdminSDHolder permissions changed for persistence

Detects scenarios where an attacker changes permissions on the AdminSDHolder container to establish persistence.