MITRE ATT&CKsub-technique

T1134.005 SID-History Injection

Published 2020-02-18 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth, Privilege Escalation
Platforms
Windows
Version
2.0
Created
2020-02-18

Description

Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. An account can hold additional SIDs in the SID-History Active Directory attribute , allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). With Domain Administrator (or equivalent) rights, harvested or well-known SID values may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as Remote Services, SMB/Windows Admin Shares, or Windows Remote Management.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1134 Access Token Manipulation technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1015 Active Directory Configuration mitigation

Referenced by MITRE ATT&CK · uses (2)

  • S0363 Empire software (tool)
  • S0002 Mimikatz software (tool)

Referenced by Compliance · mitigates (13)

  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-13 Identity Providers and Authorization Servers NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SA-17 Developer Security and Privacy Architecture and Design NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-3 Security Function Isolation NIST 800-53 control

References