AdminSDHolder
The object whose access control list serves as the template for every privileged account in the domain. A background process stamps it back every hour — including whatever the attacker put there.
The feature exists for a good reason. Without it, an administrator with limited rights could be granted lasting permissions on an account in Domain Admins and then keep them. So the SDProp process on the domain controller runs every sixty minutes and overwrites the access control list on every protected object with the AdminSDHolder template, marking the object with adminCount as it goes. The abuse is the exact mirror image: whoever manages to get write access to the template itself puts their own permission in there, and within an hour it is stamped onto every privileged account in the domain — and stamped back every hour thereafter, surviving somebody cleaning it up by hand. Classic persistence and a standing item in every review.