{"id":"2632954e-db1c-49cb-9936-67d1ef1d17d2","title":"Addition of SID History to Active Directory Object","description":"An attacker can use the SID history attribute to gain additional privileges.","author":"Thomas Patzke, @atc_project (improvements)","status":"stable","level":"medium","date":"2017-02-19","modified":"","tags":["attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1134.005"],"technique_ids":["T1134.005"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Migration of an account into a new domain"],"references":["https://adsecurity.org/?p=1772"],"source_path":"rules/windows/builtin/security/win_security_susp_add_sid_history.yml","source_sha256":"ee8cef5b23fc282cd75ab12b4538e6d0868c941b294a8a9659bfb038d36414d2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_add_sid_history.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Addition of SID History to Active Directory Object\nid: 2632954e-db1c-49cb-9936-67d1ef1d17d2\nstatus: stable\ndescription: An attacker can use the SID history attribute to gain additional privileges.\nreferences:\n    - https://adsecurity.org/?p=1772\nauthor: Thomas Patzke, @atc_project (improvements)\ndate: 2017-02-19\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1134.005\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection1:\n        EventID:\n            - 4765\n            - 4766\n    selection2:\n        EventID: 4738\n    selection3:\n        SidHistory:\n            - '-'\n            - '%%1793'\n    filter_null:\n        SidHistory:\n    condition: selection1 or (selection2 and not selection3 and not filter_null)\nfalsepositives:\n    - Migration of an account into a new domain\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1134.005","id":"T1134.005","name":"SID-History Injection","page":"techniques/enterprise/T1134.005/"}],"data_path":"data/detection-rules/2632954e-db1c-49cb-9936-67d1ef1d17d2.json","kind":"sigma"}