Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000037

AD object with privileged SIDs in the sIDHistory

Critical
Active Directory
Defense Evasion Privilege Escalation
v239

Signature Identity

CTD-000037
Threat ID
239
Version
IOC
Indicator Type

Threat Description

An Active Directory object with privileged SIDs in its sIDHistory attribute might be an indication of the threat actor’s activities.
SID (Security Identifier) is a unique identifier that Active Directory uses to identify objects as security principals in security descriptors and access tokens. In most cases, the SID History attribute is only populated with SIDs during migrations. SID History injection is an attack technique that allows a threat actor to add privileged SIDs to regular accounts and escalate privileges. For example, adding Enterprise Admin SID in the SID History of a regular user allows elevating access for the user account to an effective Domain Admin in all domains in the forest.

NOTE: Cayosoft Guardian defines privileged users in Active Directory as users with adminCount=1. By design Active Directory uses this attribute to protect members of administrative groups.

According to security best practices it is not recommended re-using admin accounts, instead these accounts must be de-provisioned. If an account has administrative permissions, it might also obtain access to other resources using these administrative permissions and keep this access even after it is removed from the administrative groups. Learn more about AdminSdHolder and SDProp – Microsoft Community Hub.

MITRE ATT&CK: Attack Tactics

Defense Evasion Privilege Escalation

D3FEND: Defend Tactics

Domain Account Monitoring User Account Permissions

Remediation

  1. Remove SIDs from the sIDHistory attribute using Powershell:Set-ADUser -Identity <account> -Remove @{SIDHistory='S-1-5-21-...'}.
  2. Investigate all activities of a user with SIDs in sIDHistory using Change History in Cayosoft Guardian.

Frequently Asked Questions

What does AD object with privileged SIDs in the sIDHistory mean?

An Active Directory object has a SID History attribute that contains one or more privileged Security Identifiers (SIDs). This occurs when an attacker adds these SIDs to the object's SID History, potentially enabling privilege escalation and unauthorized access.

The presence of privileged SIDs in the SID History attribute allows attackers to bypass security controls and obtain elevated permissions. This enables them to escalate privileges and gain unauthorized access to sensitive resources, making it a high-risk issue due to its potential for lateral movement and persistence.

Attackers can use an Active Directory object with privileged SIDs in its SID History attribute to elevate access for a user account to an effective Domain Admin in all domains within the forest. This is achieved by adding privileged SIDs to a regular account, which grants elevated permissions and allows for further reconnaissance and exploitation.

Cayosoft Guardian continuously monitors the SID History attribute of Active Directory objects and flags any detected privileged SIDs as security issues, providing visibility into potential attack paths and persistence.

Cayosoft Guardian alerts administrators to remove privileged SIDs from the SID History attribute, reducing the risk of privilege escalation and unauthorized access. Additionally, Guardian supports ongoing monitoring to quickly detect any re-added privileged SIDs, providing continuous visibility into potential security risks.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection SID History
Attack Tactics
Defense Evasion Privilege Escalation
Defend Tactics
Domain Account Monitoring User Account Permissions
Indicator Types
IOC
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical