kevmap

Techniques › T1134 › T1134.005

T1134.005 SID-History Injection

stealth · privilege escalation — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1134.005
0
KEV CVEs mapped here
<p>Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. An account can hold additional SIDs in the SID-History Active Directory attribute, allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).</p><p>With Domain Administrator (or equivalent) rights, harvested or well-known SID values may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as Remote Services, SMB/Windows Admin Shares, or Windows Remote Management.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1134.005

Addition of SID History to Active Directory Object mediumstable
Author: Thomas Patzke, @atc_project (improvements) · 2017-02-19 · logsource: product=windows service=security · 2632954e-db1c-49cb-9936-67d1ef1d17d2
An attacker can use the SID history attribute to gain additional privileges.
Techniques: T1134.005

Rules tagged at the parent level (attack.t1134) 4

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Suspicious SYSTEM User Process Creation hightest
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) · 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Techniques: T1134T1003T1027
HackTool - NoFilter Execution hightest
Author: Stamatis Chatzimangou (st0pp3r) · 2024-01-05 · logsource: product=windows service=security · 7b14c76a-c602-4ae6-9717-eff868153fc0
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
Techniques: T1134T1134.001
Suspicious Cross-User Process Spawn mediumexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-07-23 · logsource: product=windows category=process_creation · d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47
Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
Techniques: T1055T1134
Potentially Suspicious Explicit Credential Local Logon mediumexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-07-23 · logsource: product=windows service=security · e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62
Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account.
Techniques: T1134T1134.003