AdminSDHolder changed detection

🔒 Secure Bits 💡
𝗜𝗳 𝘁𝗵𝗲 𝗔𝗖𝗟 𝗼𝗻 𝗔𝗱𝗺𝗶𝗻𝗦𝗗𝗛𝗼𝗹𝗱𝗲𝗿 𝗰𝗵𝗮𝗻𝗴𝗲𝗱 — 𝘄𝗼𝘂𝗹𝗱 𝘆𝗼𝘂 𝗸𝗻𝗼𝘄 𝗮𝗯𝗼𝘂𝘁 𝗶𝘁?

Sure, it’s a bit of an extreme case… but really — would your setup catch that?

👉 You can monitor this manually 𝘂𝘀𝗶𝗻𝗴 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗔𝘂𝗱𝗶𝘁𝗶𝗻𝗴 + 𝗦𝗔𝗖𝗟 and forwarding Events to your SIEM. It’s free, it works — and it gives you visibility where it matters – 𝗯𝘂𝘁 𝗶𝘁 𝗶𝘀 𝗹𝗮𝗯𝗼𝗿𝗶𝗼𝘂𝘀, and there are many more cases to detect.

There are 𝗮𝗺𝗮𝘇𝗶𝗻𝗴 𝗰𝗼𝗺𝗺𝗲𝗿𝗰𝗶𝗮𝗹 𝘁𝗼𝗼𝗹𝘀 out there e.g. from Semperis, Forestall, Nanitor, …, — that detect vulnerabilities and changes in AD (and beyond). But let’s face it — not everyone has the 𝗯𝘂𝗱𝗴𝗲𝘁.
→ That’s why I wanted to share 𝘀𝗼𝗺𝗲𝘁𝗵𝗶𝗻𝗴 𝗳𝗿𝗲𝗲, on-prem, and surprisingly capable.

🎯 𝗖𝗮𝘆𝗼𝘀𝗼𝗳𝘁 𝗚𝘂𝗮𝗿𝗱𝗶𝗮𝗻 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗼𝗿 — I’ve been testing it lately and I’m impressed. No sponsorship here — I’ve just worked with tools like these before (who remembers ATA?), seen plenty of enterprise demos, and this one 𝗿𝗲𝗮𝗹𝗹𝘆 𝗱𝗲𝗹𝗶𝘃𝗲𝗿𝘀 𝘃𝗮𝗹𝘂𝗲 — especially for smaller orgs.
✔ Detects misconfigs, risky changes, and vulnerabilities
✔ Runs on-prem
✔ AD, Entra ID, Teams, Intune, Exchange Online
✔ It is free

I tested it with a PowerShell lab setup script by Kriss Stephen— fantastic for spinning up a 𝘁𝗲𝘀𝘁 𝗔𝗗 𝘄𝗶𝘁𝗵 𝗿𝗲𝗮𝗹𝗶𝘀𝘁𝗶𝗰 𝗺𝗶𝘀𝗰𝗼𝗻𝗳𝗶𝗴𝘀.
⚠️ Just don’t forget to change the default company size — I left it in, and came back to thousands of demo users (my bad) 🫠

𝗙𝗲𝘄 𝗲𝘅𝗮𝗺𝗽𝗹𝗲𝘀 𝗼𝗳 𝘄𝗵𝗮𝘁 𝗶𝘁 𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗲𝘀:
✔ Whole new structure in your AD with realistic data
✔ Dangerous permissions
✔ Dangerous delegations
✔ Artifacts from attacks
✔ …

🔧 Want to test your detections or evaluate tools like ADProbe? 𝗧𝗵𝗶𝘀 𝘀𝗰𝗿𝗶𝗽𝘁 𝗵𝗲𝗹𝗽𝘀 𝗮 𝗹𝗼𝘁.

✅ I’ll leave links to both tools in the comments for you.

💬 𝗛𝗼𝘄 𝗱𝗼 𝘆𝗼𝘂 𝗱𝗲𝘁𝗲𝗰𝘁 𝗰𝗵𝗮𝗻𝗴𝗲𝘀 𝗮𝗻𝗱 𝗺𝗶𝘀𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗮𝘁𝗶𝗼𝗻𝘀 𝗶𝗻 𝗔𝗗?