T1134.005Defense EvasionExpertDefense plan →

Active Directory Trust and Forest Attacks: SID History, Trust Key, and Cross-Forest Escalation

HARDEC · Savunma Güvenliği Ekibi·Published: June 13, 2026·Updated: July 15, 2026·16 min read

A comprehensive map of AD trust architecture attacks: parent-child intra-forest ExtraSids escalation, trust key theft and forged inter-realm TGT generation, SID history injection, cross-forest Kerberoasting, TGT delegation (KB4490425), and foreign security principals. Event-based and behavioral detection for SOC/DFIR, SID filtering validation, and tier-0 hardening.

Exploit

Prevention

Detection

Defense profile:3 detection rules 3 mitigations 2 baseline controls 2 response playbooks

Swipe or use the arrows to move between sections

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Information note

Attack chain prerequisites: AD cross-forest privilege escalation attacks depend on the direction of the trust relationship and the SID filtering configuration. Since the krbtgt hash in the child domain is sufficient to traverse from a child domain to a parent domain, securing this account must be the primary objective. It must be verified that SID filtering (Quarantine Flag) is enabled on all cross-forest trust relationships; in particular, for scenarios involving transitive trusts, the margin for error is zero (MITRE ATT&CK T1134.005).

Detection rules

Directly copyable rules (Sigma/KQL/…) that detect this technique. Each rule specifies its required telemetry, maturity, and source.

SID-History Injection - sIDHistory Attribute Modification on AD Object

Detects modifications to the sIDHistory attribute on Active Directory objects via Directory Service EID 5136 events. Attackers use Mimikatz 'sid::add' or DCShadow to add privileged SIDs to this attribute, enabling privilege escalation without changing group membership.

high

sigmaExperimental

Show ruleHide rule

title: SID History Injection via Active Directory sIDHistory Attribute Modification
id: 7c3e9f1b-4a2d-4b8c-a1e5-8f2d6c4b0a3e
status: experimental
description: |
  Detects modification of the sIDHistory attribute on Active Directory objects via
  Directory Service Event ID 5136. The sIDHistory attribute is used to preserve SID
  associations during domain migrations. Attackers (notably via Mimikatz 'sid::add'
  and DCShadow) inject arbitrary SIDs into this attribute to grant a compromised
  account the access rights of a privileged account (e.g., Domain Admins SID S-1-5-21-*-512)
  without modifying group membership, making detection harder. This is a persistence
  and privilege escalation technique requiring domain controller execution.
references:
  - https://attack.mitre.org/techniques/T1134/005/
  - https://adsecurity.org/?p=1772
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_add_sid_history.yml
  - https://detection.fyi/sigmahq/sigma/windows/builtin/security/win_security_susp_add_sid_history/
  - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection
author: CyberSecLab (AI)
date: 2026-06-13
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
  - attack.persistence
  - attack.t1134.005
logsource:
  product: windows
  service: security
detection:
  selection_ds_event:
    EventID: 5136
    AttributeLDAPDisplayName: 'sIDHistory'
  filter_empty_value:
    AttributeValue: ''
  condition: selection_ds_event and not filter_empty_value
falsepositives:
  - Meşru domain geçiş projeleri sırasında sIDHistory özniteliği değiştirilir
  - Active Directory araçları (ADMT - Active Directory Migration Tool) SID geçişini meşru olarak kullanır
level: high

Not validated

Telemetry required to run: Windows Security Event LogWindows Security Log (EID 5136 - Directory Service Changes)Windows

False positive: Legitimate domain migration projects (ADMT usage). This operation is extremely rare outside planned migration periods, and the source account/server making the change should be investigated.

Source: SIGMA · CC BY-SA 4.0 — AI üretimi, doğrulanmamış

Information note

Informational note: Unauthorized addition of a SID to the sIDHistory attribute of an AD object (MITRE T1134.005) allows the attacker to inherit the privileges of another domain. In parent-child domain trust relationships, this technique can be combined with a Golden Ticket to compromise the entire forest. Monitoring this attribute in Active Directory change auditing and performing a double reset of the KRBTGT password are among the preventive controls. AD events 4765/4766 on the DC are triggered.

Mitigations

Prevention and hardening measures that mitigate or block this technique.

Active Directory Configuration

Hardening

Configuration hardening measures that reduce the AD attack surface (Kerberos/RC4, delegation, krbtgt, gMSA, ACL).

Information note

Informational note: In Active Directory configuration, Unconstrained Delegation should be disabled, Constrained Delegation should be reviewed, and Kerberos pre-authentication should be enforced on all accounts (prevents AS-REP Roasting). The KRBTGT account password should be renewed periodically with a double rotation. Accounts with DCSync privileges (DS-Replication permissions) should be audited, and dedicated, monitored accounts should be used for this operation.

Privileged Account Management

Prevention

Keep the number and use of privileged accounts to a minimum: Domain Admins hygiene, LAPS, JIT/PIM.

Information note

Informational note: In privileged account management, the JIT (Just-In-Time) access model eliminates the risk of persistent administrator sessions being compromised. PAM solutions provide auditability through password vaulting, session recording, and approval workflows. In cloud environments, avoiding the use of root accounts for daily operations and assigning time-limited permissions via PIM is the foundation of modern security guidance.

Baseline controls against this technique

The following security baseline controls mitigate this technique. Compare your organization's configuration against the relevant baseline by .

Response playbooks

NIST/SANS phase-based response workflows to follow when this technique is detected.

Techniques in the Defense Evasion tactic

T1055Defense EvasionAdvanced

A comprehensive map of Windows process injection techniques: for every technique from classic DLL injection to process hollowing, Doppelgänging, APC/Early Bird, and .NET reflective assembly loading — the API chain, Sysmon/ETW detection, and defensive triad. A technical reference for red/purple team and SOC/DFIR teams.

June 13, 202618 min read

Exploit

Prevention

Detection

References

MITRE ATT&CK — T1134.005: Active Directory Trust and Forest Attacks: SID History, Trust Key, and Cross-Forest Escalation ↗

This article is based on the MITRE ATT&CK framework; the detection, defense, and response content was prepared independently.

SID-History Injection - Security Event 4765/4766 and User Account Modification

Detects SID history injection using Windows Security EID 4765 (SID History added) and EID 4766 (SID History add failed) events. These events only occur on domain controllers and are extremely rare outside of planned domain migrations. May indicate Mimikatz or DCShadow activity.

medium

sigmaExperimental

Show ruleHide rule

title: SID History Addition Detected via Security Event 4765 or 4766
id: 1a5d8c2f-7b3e-4f9a-c2e6-4d1b9f3a8c5e
status: experimental
description: |
  Detects SID history injection attempts using Windows Security Events 4765 (SID History
  was added to an account) and 4766 (An attempt to add SID History to an account failed).
  Both events are generated on domain controllers when sIDHistory attribute changes occur.
  Event 4765 indicates successful SID history addition - a rare legitimate event only
  during planned domain migrations. Event 4766 indicates a failed attempt, potentially
  indicating an attacker's tool (Mimikatz) failing due to insufficient privileges or
  detection/blocking. Both events outside a known migration window should be investigated
  as potential Mimikatz/DCShadow activity.
references:
  - https://attack.mitre.org/techniques/T1134/005/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_add_sid_history.yml
  - https://adsecurity.org/?p=1772
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4765
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.005/T1134.005.md
author: CyberSecLab (AI)
date: 2026-06-13
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
  - attack.persistence
  - attack.t1134.005
logsource:
  product: windows
  service: security
detection:
  selection_sid_events:
    EventID:
      - 4765
      - 4766
  selection_account_change_with_sidhistory:
    EventID: 4738
    'SidHistory': '*'
  filter_null_sidhistory:
    'SidHistory':
      - '-'
      - '%%1793'
      - null
  condition: selection_sid_events or (selection_account_change_with_sidhistory and not filter_null_sidhistory)
falsepositives:
  - Planlı AD domain geçiş projeleri (ADMT aracı)
  - Çok nadiren meşru kurumsal ortamlarda SID geçişi yapılabilir
level: medium

Not validated

Telemetry required to run: Windows Security Event LogWindows Security Log (EID 4765, 4766, 4738)Windows

False positive: Planned domain migration projects performed with Active Directory Migration Tool (ADMT). The source account and server context performing the change must be verified.

Source: SIGMA · CC BY-SA 4.0 — AI üretimi, doğrulanmamış

Information note

Informational note: Windows Security events 4765 (SID History added) and 4766 (failed attempt) should be extremely rare outside legitimate AD migrations; both events should be defined as high-priority alert thresholds. Requires Advanced Audit Policy enabled on the Domain Controller. Correlate with user account change event 4738 to surface the full chain.

Active Directory Trust and Forest Attacks: SID History, Trust Key, and Cross-Forest Escalation

Zafiyet (Vulnerability)

This section is not open yet

Prevention & Hardening

This section is not open yet

Detection

This section is not open yet

Detection rules

SID-History Injection - sIDHistory Attribute Modification on AD Object

Mitigations

Active Directory Configuration

Privileged Account Management

Baseline controls against this technique

Response playbooks

Techniques in the Defense Evasion tactic

References

Addition of SID History to Active Directory Object

SID-History Injection - Security Event 4765/4766 and User Account Modification

User Account Management

EDR Evasion Techniques and Detection: Syscall Abuse, Unhooking, and Telemetry Integrity

AD Active Trust Attack — SID History and Inter-Realm TGT Intervention

Token Manipulation / Privilege Escalation Response