Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Techniques

Techniques›AD Misconfigurations›SID Hijacking

AD Misconfigurations

SID Hijacking

T1550.001 · MITRE ATT&CK

SID-history injection abuses authorization SIDs carried in an account's SIDHistory or a Kerberos ticket's PAC. In this child-to-parent example, an operator with the issuing child domain's KRBTGT key forges a Golden Ticket for that child domain and adds the forest-root Enterprise Admins SID (forest-root domain SID plus RID 519) as a PAC ExtraSid. If the trust boundary accepts that SID, the ticket may authorize access in the parent domain. Forging a PAC ExtraSid this way does not itself modify an AD account's sIDHistory attribute; successful access still depends on trust filtering and resource authorization.

ArtifactsRESTRICTED_ACCESS_BLUR_MARKER

Steps1

CategoryAD ACL Abuse

Discuss in Advisor

Walkthrough

Step 1

RESTRICTED_ACCESS_BLUR_MARKER

RESTRICTED_ACCESS_BLUR_MARKER

Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)

Check before starting: RESTRICTED_ACCESS_BLUR_MARKER

Coverage Gap: No catalog tool command currently produces this step's declared outcomes.

Detection signal

Detection 01

RESTRICTED_ACCESS_BLUR_MARKER

Mitigations

Mitigation 01

RESTRICTED_ACCESS_BLUR_MARKER

OPSEC notes

RESTRICTED_ACCESS_BLUR_MARKER

References

Extended details

RESTRICTED_ACCESS_BLUR_MARKER