SID History Injection

SID History Injection adds one or more SIDs to an Active Directory account's sIDHistory attribute. At a subsequent logon, those values are included in the account's access token and can grant access to resources whose ACLs authorize those SIDs. Cross-domain effect depends on trust filtering and resource ACLs. Modifying the attribute requires Domain Administrator or equivalent directory rights. The Mimikatz procedure documented below is limited to compatible pre-Windows Server 2016 domain controllers.