What is SID in Computer Systems?

SID History is a legitimate Active Directory attribute that preserves a user's SID from a previous domain during migrations, allowing access to old resources to continue without permission reassignment. Attackers exploit this by injecting additional SIDs — including high-privilege SIDs like Domain Admins — into a user account's SID History attribute. Because Windows access tokens include SID History values, the injected SID grants the user all privileges associated with the injected group without any visible group membership change. This attack is subtle precisely because the user's group memberships appear normal in standard Active Directory views — the malicious privilege lives in the SID History attribute, which requires specific audit queries to detect. Detection: query all Active Directory accounts for non-empty SID History attributes and cross-reference with expected migration history. Huntress's identity threat detection capabilities monitor for anomalous privilege escalation patterns, including unexpected SID History modifications, as part of active directory protection. Link to the Active Directory and Privileged Access Management pages.