---
id: 5844
title: "How to Defend Against SID History Injection"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/how-to-defend-against-sid-history-injection/"
published_at: "2024-05-03T20:16:17Z"
tags: ["active-directory", "privilege-escalation", "defense", "detection", "persistence", "sid-history"]
phying_url: "https://phying.com/item/5844"
lang: en
---

# How to Defend Against SID History Injection

## Summary

SID History injection abuses a domain-migration feature: attackers inject a Domain Admins SID into an account's SID History to escalate silently, bypassing group-membership checks.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2024-05-03T20:16:17Z
- **Original:** https://www.semperis.com/blog/how-to-defend-against-sid-history-injection/
- **Phying News:** https://phying.com/item/5844