T1134.005 — SID-History Injection

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. An account can hold…

Sub-technique of Access Token Manipulation (T1134).

Sigma detection rules (1)

T1134.005 Access Token Manipulation: SID-History Injection

title: "T1134.005 Access Token Manipulation: SID-History Injection"
id: 416bc441-da91-4f5c-b0aa-eb19212425dd
description: 'Detects Active Directory object modifications specifically to the sIDHistory attribute via Security EventID 5136. (Data Component: Active Directory Object Modification; baseline tier: windows-eventid.) Tune using: AllowedSIDHistoryChanges, TimeWindow, PrivilegedSIDList, UserContextFilter, AnomalousSIDCountThreshold.'
references:
  - https://attack.mitre.org/techniques/T1134/005
author: Shahrukh Khan
date: 2026-01-28
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1134.005

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: 'sIDHistory'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate inter-domain account migrations performed by AD administrators using ADMT or an equivalent migration tool.

level: medium

Related sub-techniques

Explore