ID | Technique | Tactic |
---|---|---|
T1134.005 | SID-History Injection | Defense Evasion |
T1134 | Access Token Manipulation | Privilege Escalation |
Detection: Windows AD Privileged Account SID History Addition
Description
The following analytic identifies when the SID of a privileged user is added to the SID History attribute of another user. It leverages Windows Security Event Codes 4742 and 4738, combined with identity lookups, to detect this activity. This behavior is significant as it may indicate an attempt to abuse SID history for unauthorized access across multiple domains. If confirmed malicious, this activity could allow an attacker to escalate privileges or maintain persistent access within the environment, posing a significant security risk.
Search
1`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -)
2| rex field=SidHistory "(^%{
3|^)(?P<SidHistory>.*?)(}$
4|$)"
5| eval category="privileged"
6| lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match
7| where isnotnull(match)
8| rename TargetSid as userSid
9| table _time action status host user userSid SidHistory Logon_ID src_user
10| `windows_ad_privileged_account_sid_history_addition_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
Windows Event Log Security 4738 | Windows | 'xmlwineventlog' |
'XmlWinEventLog:Security' |
N/A |
Macros Used
Name | Value |
---|---|
wineventlog_security | eventtype=wineventlog_security OR Channel=security OR source=XmlWinEventLog:Security |
windows_ad_privileged_account_sid_history_addition_filter | search * |
windows_ad_privileged_account_sid_history_addition_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
Ensure you have objectSid and the Down Level Logon Name DOMAIN\sAMACountName
added to the identity field of your Asset and Identities lookup, along with the category of privileged for the applicable users. Ensure you are ingesting eventcodes 4742 and 4738. Two advanced audit policies Audit User Account Management
and Audit Computer Account Management
under Account Management
are required to generate these event codes.
Known False Positives
Migration of privileged accounts.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
A Privileged User Account SID History Attribute was added to $userSid$ by $src_user$ | 90 | 100 | 90 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | XmlWinEventLog:Security |
xmlwineventlog |
Integration | ✅ Passing | Dataset | XmlWinEventLog:Security |
xmlwineventlog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 3