Active Directory Güven ve Orman Saldırıları: SID History, Güven Anahtarı ve Ormanlar Arası Yükseltme

title: SID History Injection via Active Directory sIDHistory Attribute Modification
id: 7c3e9f1b-4a2d-4b8c-a1e5-8f2d6c4b0a3e
status: experimental
description: |
  Detects modification of the sIDHistory attribute on Active Directory objects via
  Directory Service Event ID 5136. The sIDHistory attribute is used to preserve SID
  associations during domain migrations. Attackers (notably via Mimikatz 'sid::add'
  and DCShadow) inject arbitrary SIDs into this attribute to grant a compromised
  account the access rights of a privileged account (e.g., Domain Admins SID S-1-5-21-*-512)
  without modifying group membership, making detection harder. This is a persistence
  and privilege escalation technique requiring domain controller execution.
references:
  - https://attack.mitre.org/techniques/T1134/005/
  - https://adsecurity.org/?p=1772
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_add_sid_history.yml
  - https://detection.fyi/sigmahq/sigma/windows/builtin/security/win_security_susp_add_sid_history/
  - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection
author: CyberSecLab (AI)
date: 2026-06-13
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
  - attack.persistence
  - attack.t1134.005
logsource:
  product: windows
  service: security
detection:
  selection_ds_event:
    EventID: 5136
    AttributeLDAPDisplayName: 'sIDHistory'
  filter_empty_value:
    AttributeValue: ''
  condition: selection_ds_event and not filter_empty_value
falsepositives:
  - Meşru domain geçiş projeleri sırasında sIDHistory özniteliği değiştirilir
  - Active Directory araçları (ADMT - Active Directory Migration Tool) SID geçişini meşru olarak kullanır
level: high