Cross-source coverage

T1134.005 / ATT&CK

Access Token Manipulation: SID-History Injection

5 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. An account can hold additional SIDs in the SID-History Active Directory attribute, allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).

With Domain Administrator (or equivalent) rights, harvested or well-known SID values may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as Remote Services, SMB/Windows Admin Shares, or Windows Remote Management.

Platforms
Windows
Telemetry
WinEventLog:Securityetw:Microsoft-Windows-Directory-Services-SAM

How MITRE says to detect it DET0136

Behavior-chain detection for T1134.005 Access Token Manipulation: SID-History Injection (Windows)

Windows Analytic 0383

Detection of unauthorized modification of Active Directory SID-History attributes to escalate privileges. This chain involves: (1) privileged operations or API calls to DsAddSidHistory or related AD modification functions, (2) observed attribute changes in SID-History (Event ID 5136), (3) new logon sessions where the token includes unexpected or privileged SID-History values, and (4) follow-on resource access using elevated privileges derived from SID-History injection.

  • WinEventLog:Security EventCode=5136
  • WinEventLog:Security EventCode=4720, 4738
  • etw:Microsoft-Windows-Directory-Services-SAM api_call: Calls to DsAddSidHistory or related RPC operations

View on attack.mitre.org ↗

splunk/security_content

4 rules
Detection Severity Format
Windows AD Cross Domain SID History Addition Undefined SPL
Windows AD Privileged Account SID History Addition Undefined SPL
Windows AD Same Domain SID History Addition Undefined SPL
Windows AD SID History Attribute Modified Undefined SPL

SigmaHQ/sigma

1 rule
Detection Severity Format
Addition of SID History to Active Directory Object Medium Sigma

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.