Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
5
3
3
2
1
Contributors
5
3
2
2
1
Categories
8
8
7
2
2
Platforms
12
2
Products / Services
11
10
2
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
IDS Protocols
2
The following analytic identifies when the SID of a privileged user is added to the SID History attribute of another user. It leverages Windows Security Event Codes 4742 and 4738, combined with identity lookups, to detect this activity. This behavior is significant as it may indicate an attempt to abuse SID history for unauthorized access across multiple domains. If confirmed malicious, this activity could allow an attacker to escalate privileges or maintain persistent access within the environment, posing a significant security risk.
AD User / Computer Profile
Cortex XDR
Search user by sam_account_name in pan_dss_raw. Returns full AD profile with UAC decoded to readable text, sensitive group membership check (Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account/Backup/Server Operators, DnsAdmins, GPO Creators, RDP Users, adminSDHolder). Variable: $input_username_or_computer_name
This rule detects the modification of the SID History attribute on Active Directory accounts (Event ID 4765) or failed attempts to do so (Event ID 4766). The SID History attribute can be abused to gain unauthorized access and escalate privileges across domain boundaries by injecting well-known or administrative SIDs, a technique known as SID-History Injection.
This rule detects the modification of the SID History attribute on Active Directory accounts (Event ID 4765) or failed attempts to do so (Event ID 4766). The SID History attribute can be abused to gain unauthorized access and escalate privileges across domain boundaries by injecting well-known or administrative SIDs, a technique known as SID-History Injection.
Detects SID history manipulation for domain privilege escalation
This rule detects attempts to perform SID History Injection via DCSync Replication. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "DsAddSidHistory" case-insensitively. This activity is indicative of an attacker attempting to add a Security Identifier (SID) from another account to a target account's SIDHistory attribute, often as part of a privilege escalation technique like DCSync attacks, to gain unauthorized access or maintain persistence within an Active Directory environment.
This rule detects when the 'sIDHistory' attribute is added to a domain account. This is a common technique used in privilege escalation, particularly in Active Directory environments, where an attacker adds the SID of a highly privileged account (like a Domain Admin) to a compromised account's sIDHistory. This grants the compromised account the privileges of the added SID without changing its primary SID.
An attacker can use the SID history attribute to gain additional privileges.
This rule detects the addition of a Security Identifier (SID) to an Active Directory object's SID History attribute. Attackers can manipulate the SID History to gain unauthorized privileges, often by adding SIDs of highly privileged accounts (like Domain Admins) to a compromised user or computer object. This allows the compromised account to impersonate the privileged account and bypass access controls. The rule specifically looks for Event IDs 4765 (SID History added to an account) or 4766 (SID History added to a group) or Event ID 4738 (User Account Changed) where the 'SidHistory' field is not null or '%%1793' (which indicates no SID History).
An attacker can use the SID history attribute to gain additional privileges.
The following analytic detects modifications to the SID History attribute in Active Directory by leveraging event code 5136. This detection uses logs from the `wineventlog_security` data source to identify changes to the sIDHistory attribute. Monitoring this activity is crucial as the SID History attribute can be exploited by adversaries to inherit permissions from other accounts, potentially granting unauthorized access. If confirmed malicious, this activity could allow attackers to maintain persistent access and escalate privileges within the domain, posing a significant security risk.
This analytic detects changes to the sIDHistory attribute of user or computer objects within the same domain. It leverages Windows Security Event Codes 4738 (User Account Changed) and 4742 (Computer Account Changed) to identify when the sIDHistory attribute is modified. This activity is significant because the sIDHistory attribute can be abused by adversaries to grant unauthorized access by inheriting permissions from another account. If confirmed malicious, this could allow attackers to maintain persistent access or escalate privileges within the domain, posing a severe security risk. The rule specifically looks for cases where the added SID History matches the target SID or target domain name, indicating an attempt to add a SID from the same domain.
The following analytic detects changes to the sIDHistory attribute of user or computer objects across different domains. It leverages Windows Security Event Codes 4738 and 4742 to identify when the sIDHistory attribute is modified. This activity is significant because the sIDHistory attribute allows users to inherit permissions from other AD accounts, which can be exploited by adversaries for inter-domain privilege escalation and persistence. If confirmed malicious, this could enable attackers to gain unauthorized access to resources, maintain persistence, and escalate privileges across domain boundaries.
This analytic identifies when the Security Identifier (SID) of a privileged user is added to the SID History attribute of another user account in Active Directory. It specifically looks for Windows Security Event Codes 4742 (A computer account was changed) and 4738 (A user account was changed), combined with identity lookups to determine if the added SID belongs to a privileged account. This activity is critical as it can indicate an attempt to abuse SID history for unauthorized access, privilege escalation, or persistent access within an environment, posing a significant security risk.