Windows Security Events: SID History Added to Active Directory Object
Flags Windows Security events indicating Active Directory SIDHistory changes that can grant additional privileges.
- Product
- windows
- Service
- security
- Author
- Thomas Patzke, @atc_project (improvements) (SigmaHQ), DRL 1.1
- Published
- 2017-02-19
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Active Directory changes involving the SIDHistory attribute, using Windows Security audit events that record account modifications. Attackers can abuse SID history to retain or gain effective access in a different domain, supporting persistence and privilege escalation. The detection relies on Event IDs 4765 or 4766 in conjunction with 4738, and checks for specific SIDHistory values while excluding cases where SIDHistory is null or matches the defined non-suspicious pattern.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security Events: SID History Added to Active Directory Object"
id: 260b8c47-3316-4c96-aadc-efbfda809765
status: stable
description: This rule flags Active Directory changes involving the SIDHistory attribute, using Windows Security audit events that record account modifications. Attackers can abuse SID history to retain or gain effective access in a different domain, supporting persistence and privilege escalation. The detection relies on Event IDs 4765 or 4766 in conjunction with 4738, and checks for specific SIDHistory values while excluding cases where SIDHistory is null or matches the defined non-suspicious pattern.
references:
- https://adsecurity.org/?p=1772
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_add_sid_history.yml
author: Thomas Patzke, @atc_project (improvements), Huntrule Team
date: 2017-02-19
tags:
- attack.persistence
- attack.privilege-escalation
- attack.stealth
- attack.t1134.005
logsource:
product: windows
service: security
detection:
selection1:
EventID:
- 4765
- 4766
selection2:
EventID: 4738
selection3:
SidHistory:
- "-"
- "%%1793"
filter_null:
SidHistory: null
condition: selection1 or (selection2 and not selection3 and not filter_null)
falsepositives:
- Migration of an account into a new domain
level: medium
license: DRL-1.1
related:
- id: 2632954e-db1c-49cb-9936-67d1ef1d17d2
type: derived