Windows AD SID History Attribute Modified

name: Windows AD SID History Attribute Modified
id: 1155e47d-307f-4247-beab-71071e3a458c
version: 11
creation_date: '2022-11-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the SID History attribute in Active Directory by leveraging event code 5136. This detection uses logs from the `wineventlog_security` data source to identify changes to the sIDHistory attribute. Monitoring this activity is crucial as the SID History attribute can be exploited by adversaries to inherit permissions from other accounts, potentially granting unauthorized access. If confirmed malicious, this activity could allow attackers to maintain persistent access and escalate privileges within the domain, posing a significant security risk.
data_source:
    - Windows Event Log Security 5136
search: |-
    `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=sIDHistory OperationType="%%14674"
      | stats values(ObjectDN) as ObjectDN
        BY _time, Computer, SubjectUserName,
           AttributeValue
      | rename Computer as dest
      | `windows_ad_sid_history_attribute_modified_filter`
how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for AD objects in order to ingest attribute modifications.
known_false_positives: Domain mergers and migrations may generate large volumes of false positives for this analytic.
references:
    - https://adsecurity.org/?p=1772
    - https://learn.microsoft.com/en-us/windows/win32/adschema/a-sidhistory?redirectedfrom=MSDN
    - https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute
    - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection
finding:
    title: SID History AD attribute modified by $SubjectUserName$ for $ObjectDN$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1134.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint