This query detects modification in the AdminSDHolder  in the Active Directory which could indicate an attempt for persistence. 
AdminSDHolder Modification is a persistence technique in which an attacker abuses the SDProp process in Active Directory to establish a persistent backdoor to Active Directory.
This query searches for the event id 5136 where the Object DN is AdminSDHolder.

Adding reference