Techniques › T1134.005 › AN0383
AN0383 Analytic 0383
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of unauthorized modification of Active Directory SID-History attributes to escalate privileges. This chain involves: (1) privileged operations or API calls to DsAddSidHistory or related AD modification functions, (2) observed attribute changes in SID-History (Event ID 5136), (3) new logon sessions where the token includes unexpected or privileged SID-History values, and (4) follow-on resource access using elevated privileges derived from SID-History injection.</p>
- Detects
- T1134.005 SID-History Injection
- Part of
- DET0136 Behavior-chain detection for T1134.005 Access Token Manipulation: SID-History Injection (Windows)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=5136 | DC0066 Active Directory Object Modification |
| WinEventLog:Security | EventCode=4720, 4738 | DC0013 User Account Metadata |
| etw:Microsoft-Windows-Directory-Services-SAM | api_call: Calls to DsAddSidHistory or related RPC operations | DC0021 OS API Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedSIDHistoryChanges | Approved migration windows or known SID-History population events. |
TimeWindow | Correlation window between attribute change and suspicious logon activity (default 15–30 minutes). |
PrivilegedSIDList | List of sensitive SIDs (e.g., Enterprise Admins, Domain Admins) that should never appear in SID-History. |
UserContextFilter | Exclude trusted migration service accounts or pre-approved administrative tasks. |
AnomalousSIDCountThreshold | Raise alerts when a token contains more than X SID-History entries (default X=2). |