Windows Event ID 4780 — The ACL was set on accounts which are members of administrators groups

ACL set on admin account by AdminSDHolder SDProp process. Fires hourly for protected accounts.

Why event 4780 matters

AdminSDHolder manipulation grants persistent privileged access that survives typical cleanup. SDProp runs hourly resetting ACLs — 4780 fires each time. Attackers modify AdminSDHolder to persist.

How to detect it

Alert: SubjectUserName is not SYSTEM. Normal: SYSTEM applies ACLs during SDProp. Abnormal: any other account modifying admin ACLs.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

SecurityEvent
| where EventID == 4780   // The ACL was set on accounts which are members of administrators groups
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Security" EventCode=4780
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The ACL was set on accounts which are members of administrators groups — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Related Account Management events