t1134-005-sid-history-injection

name	T1134.005_sid-history-injection
description	Adversaries may use SID-History Injection to escalate privileges and bypass access controls.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1134.005","defense-evasion","privilege-escalation","windows","sub-technique"]
technique_id	T1134.005
tactic	defense-evasion
all_tactics	["defense-evasion","privilege-escalation"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1134/005
tech_stack	["windows"]
cwe_ids	["CWE-693"]
chains_with	["T1134","T1134.001","T1134.002","T1134.003","T1134.004"]
prerequisites	["T1134"]
severity_boost	{"T1134":"Chain with T1134 for deeper attack path","T1134.001":"Chain with T1134.001 for deeper attack path","T1134.002":"Chain with T1134.002 for deeper attack path"}

T1134.005 SID-History Injection

Sub-technique of: T1134

High-Level Description

Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. An account can hold additional SIDs in the SID-History Active Directory attribute , allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).

With Domain Administrator (or equivalent) rights, harvested or well-known SID values may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as Remote Services, SMB/Windows Admin Shares, or Windows Remote Management.

Kill Chain Phase

• Defense Evasion (TA0005)
• Privilege Escalation (TA0004)

Platforms: Windows

What to Check

• Identify if SID-History Injection technique is applicable to target environment
• Check Windows systems for indicators of SID-History Injection
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Injection SID-History with mimikatz

Adversaries may use SID-History Injection to escalate privileges and bypass access controls. Must be run on domain controller

Supported Platforms: windows Elevation Required: Yes

#{mimikatz_path} "privilege::debug" "sid::patch" "sid::add /sid:#{sid_to_inject} /sam:#{sam_account_name}" "exit"

Dependencies:

• Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by: