Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000128

Regular AD object with Migrate SID history permission

Medium
Active Directory
Credential Access Defense Evasion Persistence Privilege Escalation
v19

Signature Identity

CTD-000128
Threat ID
19
Version
IOE
Indicator Type

Threat Description

The Migrate sIDHistory permission in Active Directory allows an account to add or modify the sIDHistory attribute of a user or group. Delegating this permission to a regular user poses significant security threats. A threat actor can exploit this by migrating the SID of a high-privilege account into their own account, effectively gaining the same access rights and privileges. They can also add SIDs to access restricted resources, maintain persistence by hiding elevated privileges in a stealthy account, and evade security monitoring by masking their activities.

To mitigate these risks, restrict sIDHistory permissions to trusted administrative accounts, conduct regular audits, and monitor changes to the sIDHistory attribute.

NOTE: Cayosoft Guardian defines privileged users in Active Directory as users with adminCount=1. By design, Active Directory uses the attribute to protect members of administrative groups.

According to security best practices, it is not recommended to re-use admin accounts. Instead, these accounts must be de-provisioned. If an account has administrative permissions, it might also obtain access to other resources using these administrative permissions and keep this access even after it is removed from the administrative groups. Learn more about AdminSdHolder and SDProp – Microsoft Community Hub.

MITRE ATT&CK: Attack Tactics

Credential Access Defense Evasion Persistence Privilege Escalation

D3FEND: Defend Tactics

User Account Permissions

Remediation

To remove the Migrate sIDHistory permission from a container in Active Directory: 

  1. Open the Active Directory Users and Computers (ADUC) tool:
    1. Click on the Start menu.
    2. Type dsa.msc.
    3. Press Enter. The Active Directory Users and Computers console will open. 
  2. In ADUC, click the View menu.
  3. Select Advanced Features. This enables additional tabs and options in the Properties dialogs. 
  4. In the left pane, navigate to the domain object. 
  5. Right-click the container.
  6. Select Properties. 
  7. Go to the Security tab in the Properties window. 
  8. Click the Advanced button. The Advanced Security Settings window will open.
  9. On the Permissions tab of the Advanced Security Settings window, find the entry that includes Migrate sIDHistory permission. 
  10. The entry will typically be under the Applies to column indicating where the permission is applied and under the Permissions or Access column detailing the specific rights. 
  11. Remove the permission. 
  12. Select the entry that grants the Migrate sIDHistory permission. 
  13. Click Remove to delete this permission entry. 
  14. Click Apply.
  15. Click OK to close the Advanced Security Settings window. 
  16. Click OK again to close the container properties window. 

By following these steps, you can successfully remove the Migrate sIDHistory permission from a container in Active Directory, ensuring that no unauthorized user or group retains this permission.

Frequently Asked Questions

What does Regular AD object with Migrate SID history permission mean?

A non-administrative user or group has been granted the 'Migrate sIDHistory' permission in Active Directory, allowing them to modify the sIDHistory attribute of other users or groups. This permission is typically reserved for trusted administrative accounts.

This permission allows a threat actor to migrate the SID of a high-privilege account into their own account, effectively gaining the same access rights and privileges. This can be used for privilege escalation and credential access.

An attacker can exploit this permission by migrating the SID of a high-privilege account into their own account, allowing them to access resources and perform actions restricted to the original account's owner.

Cayosoft Guardian detects this permission by continuously monitoring the permissions assigned to regular users or groups in Active Directory, flagging non-administrative users or groups with this permission as a security issue.

Cayosoft Guardian alerts administrators to remove this permission from non-administrative users or groups, ensuring only trusted administrative accounts have access to sensitive permissions and reducing the attack surface.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection
Attack Tactics
Credential Access Defense Evasion Persistence Privilege Escalation
Defend Tactics
User Account Permissions
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical