Skip to content
Threat Feed

Tag

Sidhistory

1 brief RSS
high advisory

Windows AD sIDHistory Attribute Modification Detection

This analytic detects changes to the sIDHistory attribute of user or computer objects within the same domain using Windows Security Event Codes 4738 and 4742, which can be abused by adversaries to gain unauthorized access, maintain persistence, or escalate privileges by inheriting permissions from another account.

Splunk Enterprise +2 sidhistory active-directory privilege-escalation persistence windows
2r 2t