AdminSDHolder and SID History
Also calledAdminSDHolder abuse, SID history injection, SIDHistory
Two quiet ways to keep admin access, a template ACL or a SID in an account's history.
- Technique
- MITRE ATT&CK T1098.007: Account Manipulation: Additional Local or Domain Groups (opens in a new tab)MITRE ATT&CK T1134.005: Access Token Manipulation: SID-History Injection (opens in a new tab)
- Needs
- Domain AdminorDirectory Write
- Gives
- Domain Admin
How the Attack Works
AdminSDHolder is a template object whose security descriptor the directory stamps onto every protected admin account about once an hour, so a change to that template re-grants access across all of them at once, with nothing on the accounts to show it. SID history is an attribute that lets an account migrated between domains keep its old group memberships, so a privileged group's identifier placed there grants that group's access with no membership to show for it. Both are ordinary directory features, so the signal is a change to the AdminSDHolder object, or a SID appearing in an account's history that no migration explains.
Read first Authentication and Authorisation
How It Plays Out
The attack step by step. Each step shows which machines take part, what travels, the keys and tickets each side now holds, what is logged and what a defender can see.
ws-042 Foothold
dc-01 Domain controller
Step 1 of 3: SID History Added
ws-042 Foothold to dc-01 Domain controller
A SID added to the account history
DsAddSidHistoryDRS RPCThe Domain Admins SID is added to the support account's sIDHistory on dc-01, an account never migrated between domains.
Logged
4765 SID History was added to an account
On dc-01, in the Security log
SID History added to CORP\support, the SID list carrying the Domain Admins SID.
What Defenders See
With Audit User Account Management on, dc-01 writes event 4765 naming the target account and the SID added.
Step 2 of 3: ACL Re-Stamped
On dc-01 Domain controller
Every hour the PDC stamps the AdminSDHolder ACL onto the protected accounts, so a tampered template re-grants access across all of them.
Logged
4780 The ACL was set on accounts which are members of administrators groups
On dc-01, in the Security log When enabled
The ACL on admin-group members reset to the AdminSDHolder template.
What Defenders See
The Security log on dc-01 shows event 4780 as each admin account's ACL is reset to the template, whatever that template now grants.
Step 3 of 3: Hidden Admin Access
ws-042 Foothold to dc-01 Domain controller
Admin access with no membership
LDAP SearchRequestLDAP, port 389The support account reaches the directory as a Domain Admin through the SID in its history, with no group membership to show it.
What Defenders See
The Security log on dc-01 shows the support account using admin rights while it is in no admin group. Defender for Identity raises its SID-history injection and AdminSDHolder alerts.
Needs First
What the attacker must already hold for this attack to be possible.
- Domain Admin Rights or Write Access to a Directory ObjectDomain Admin, or write access to AdminSDHolder or an account's SID history.
Comes From
- Domain Admin: Golden Ticket, Diamond and Sapphire Tickets, Certificate Services Abuse, noPac (sAMAccountName Spoofing)
- Directory Write: DCShadow
Gives the Attacker
What running it hands the attacker to use next.
- Domain Admin RightsLasting admin access that no group membership shows, through the template ACL or the SID in history.
What Defenders See
What this attack leaves for a defender to find, and what to read in each. None of it is proof on its own, so treat each as a lead and confirm it against the rest.
| Event and Log | Written On | Look For | Switch It On |
|---|---|---|---|
| 5136 A directory service object was modified (opens in a new tab) Security log | Domain controllers, for objects with a matching audit entry | A change to the AdminSDHolder object, or to an account's sIDHistory, with an audit entry set and Audit Directory Service Changes on. | Audit Directory Service Changes, and an audit entry (SACL) on the object |
| 4765 SID History was added to an account (opens in a new tab) Security log | Domain controllers | SID history added to an account that was never migrated, the SID list naming a privileged group such as Domain Admins. | Audit User Account Management |
| 4766 An attempt to add SID History to an account failed (opens in a new tab) Security log | Domain controllers | A failed attempt to add SID history, which can mark a blocked or mistimed attempt worth running down. | Audit User Account Management |
| 4780 The ACL was set on accounts which are members of administrators groups (opens in a new tab) Security log | The domain controller that holds the PDC role, when its hourly check resets an admin account to the AdminSDHolder template | The ACL reset on admin-group members to the AdminSDHolder template, which lands whatever that template now grants. | Audit User Account Management |
What It Looks Like
One event from the worked example, decoded field by field, so you can see what to read in it and what each value means.
4765 SID History was added to an account
In the Security log on dc-01,
A Domain Admins SID added to the support account's history on dc-01.
The account that gained SID history, the new support account from the incident. It was never migrated between domains, so it should have none.
As Windows writes it:
Target AccountCORP\supportThe SID added ends 512, the Domain Admins group. The support account now carries Domain Admin access with no group membership to show it.
As Windows writes it:
SID ListS-1-5-21-...-512The account that made the change. Find where it signed in from, since its rights did this.
As Windows writes it:
Source AccountCORP\Administrator
Defender for Identity Alerts
Where Defender for Identity runs, its sensors raise these from what they read on the servers they are installed on, domain controllers above all. Each names what it flags, which is a lead to confirm, not proof on its own.
- Suspicious modification of domain AdminSdHolder (opens in a new tab)
- Suspected SID-History injection (opens in a new tab)
Blind Spots
Where this attack leaves little or nothing to see, so a quiet log is not read as an all-clear.
- SID history re-grants a group's access with no event 4728 in the Security log, so a membership review misses it. The sIDHistory attribute has to be read on each account.
- A tampered AdminSDHolder re-applies its access control list every hour, so correcting one account is undone until the template object itself is put right.
Hunt It
The query to run in each tool, and how well each one sees this attack. Pick the tool you use, and the others load their query when you open them.
Needs Defender for Identity sensors on every DC. The alerts mark a changed AdminSDHolder object or a new SID in an account's history. Read the account's sIDHistory and the template's access control list to confirm.
// Defender for Identity AdminSDHolder and SID-history alertsAlertEvidence| where Timestamp > ago(How to Prevent It
The controls that break this attack, each with how it helps here and, where the Registry topic has it, where to check it on a machine.
Least-privilege administration (opens in a new tab)
Keep write access to the AdminSDHolder object and to admin accounts to as few hands as possible.
Tiered administration (opens in a new tab)
Separate admin tiers, so the rights needed to tamper with protected accounts are not sitting on everyday machines.
Replication rights reviewed (opens in a new tab)
Review who can replicate the directory, since SID history is often injected over replication.
Sources
- MITRE ATT&CK T1098.007: Account Manipulation: Additional Local or Domain Groups (opens in a new tab)
- MITRE ATT&CK T1134.005: Access Token Manipulation: SID-History Injection (opens in a new tab)
- Microsoft Learn: Appendix C, protected accounts and groups in Active Directory (opens in a new tab)
- Microsoft Learn: SID-History attribute (opens in a new tab)
- Microsoft Learn: 4765, SID History was added to an account (opens in a new tab)
- Microsoft Learn: 4780, the ACL was set on accounts which are members of administrators groups (opens in a new tab)
- Microsoft Learn: Defender for Identity persistence and privilege escalation alerts (opens in a new tab)