Windows Security: AD Account SIDHistory Added or Modified (Event 4765/4766/4738)

Flags Windows Security events indicating Active Directory SIDHistory changes that can grant additional privileges.

FreeUnreviewedSigmamediumv1

windows-security-ad-account-sidhistory-added-or-modified-event-4765-4766-4738-2632954e

title: "Windows Security: AD Account SIDHistory Added or Modified (Event 4765/4766/4738)"
id: 260b8c47-3316-4c96-aadc-efbfda809765
status: stable
description: This rule identifies changes to Active Directory object security identifiers by flagging SIDHistory additions or updates. Attackers may use SID history to inherit group and access privileges from prior domains, enabling persistence and stealthy privilege escalation. The detection relies on Windows Security auditing events that record account modifications and SIDHistory presence/absence, matched by EventID 4765/4766 and conditional EventID 4738 with SIDHistory not equal to empty or a wildcard placeholder.
references:
  - https://adsecurity.org/?p=1772
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_add_sid_history.yml
author: Thomas Patzke, @atc_project (improvements), Huntrule Team
date: 2017-02-19
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.005
logsource:
  product: windows
  service: security
detection:
  selection1:
    EventID:
      - 4765
      - 4766
  selection2:
    EventID: 4738
  selection3:
    SidHistory:
      - "-"
      - "%%1793"
  filter_null:
    SidHistory: null
  condition: selection1 or (selection2 and not selection3 and not filter_null)
falsepositives:
  - Migration of an account into a new domain
level: medium
license: DRL-1.1
related:
  - id: 2632954e-db1c-49cb-9936-67d1ef1d17d2
    type: derived

What it detects

This rule identifies changes to Active Directory object security identifiers by flagging SIDHistory additions or updates. Attackers may use SID history to inherit group and access privileges from prior domains, enabling persistence and stealthy privilege escalation. The detection relies on Windows Security auditing events that record account modifications and SIDHistory presence/absence, matched by EventID 4765/4766 and conditional EventID 4738 with SIDHistory not equal to empty or a wildcard placeholder.

Known false positives

Migration of an account into a new domain

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.