Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).

With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).
SID-History Injection
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1134/005  external_id: T1134.005     source_name: Microsoft SID  description: Microsoft. (n.d.). Security Identifiers. Retrieved November 30, 2017.  url: https://msdn.microsoft.com/library/windows/desktop/aa379571.aspx     source_name: Microsoft SID-History Attribute  description: Microsoft. (n.d.). Active Directory Schema - SID-History attribute. Retrieved November 30, 2017.  url: https://msdn.microsoft.com/library/ms679833.aspx     source_name: Microsoft Well Known SIDs Jun 2017  description: Microsoft. (2017, June 23). Well-known security identifiers in Windows operating systems. Retrieved November 30, 2017.  url: https://support.microsoft.com/help/243330/well-known-security-identifiers-in-windows-operating-systems     source_name: Microsoft Get-ADUser  description: Microsoft. (n.d.). Active Directory Cmdlets - Get-ADUser. Retrieved November 30, 2017.  url: https://technet.microsoft.com/library/ee617241.aspx     source_name: AdSecurity SID History Sept 2015  description: Metcalf, S. (2015, September 19). Sneaky Active Directory Persistence #14: SID History. Retrieved November 30, 2017.  url: https://adsecurity.org/?p=1772     source_name: Microsoft DsAddSidHistory  description: Microsoft. (n.d.). Using DsAddSidHistory. Retrieved November 30, 2017.  url: https://msdn.microsoft.com/library/ms677982.aspx     