type: attack-pattern
spec_version: 2.1
id: attack-pattern--1df0326d-2fbc-4d08-a16b-48365f1e742d
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1178
external_id: T1178
source_name: Microsoft SID
description: Microsoft. (n.d.). Security Identifiers. Retrieved November 30, 2017.
url: https://msdn.microsoft.com/library/windows/desktop/aa379571.aspx
source_name: Microsoft SID-History Attribute
description: Microsoft. (n.d.). Active Directory Schema - SID-History attribute. Retrieved November 30, 2017.
url: https://msdn.microsoft.com/library/ms679833.aspx
source_name: Microsoft Well Known SIDs Jun 2017
description: Microsoft. (2017, June 23). Well-known security identifiers in Windows operating systems. Retrieved November 30, 2017.
url: https://support.microsoft.com/help/243330/well-known-security-identifiers-in-windows-operating-systems
source_name: Microsoft Get-ADUser
description: Microsoft. (n.d.). Active Directory Cmdlets - Get-ADUser. Retrieved November 30, 2017.
url: https://technet.microsoft.com/library/ee617241.aspx
source_name: AdSecurity SID History Sept 2015
description: Metcalf, S. (2015, September 19). Sneaky Active Directory Persistence #14: SID History. Retrieved November 30, 2017.
url: https://adsecurity.org/?p=1772
source_name: Microsoft DsAddSidHistory
description: Microsoft. (n.d.). Using DsAddSidHistory. Retrieved November 30, 2017.
url: https://msdn.microsoft.com/library/ms677982.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:29.579Z
name: SID-History Injection
description: The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).

Adversaries may use this mechanism for privilege escalation. With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [Windows Admin Shares](https://attack.mitre.org/techniques/T1077), or [Windows Remote Management](https://attack.mitre.org/techniques/T1028).
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: privilege-escalation
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Vincent Le Toux
Alain Homewood, Insomnia Security
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_version: 1.1