SID History Injection via DCSync Replication

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•6

This rule detects attempts to perform SID History Injection via DCSync Replication. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "DsAddSidHistory" case-insensitively. This activity is indicative of an attacker attempting to add a Security Identifier (SID) from another account to a target account's SIDHistory attribute, often as part of a privilege escalation technique like DCSync attacks, to gain unauthorized access or maintain persistence within an Active Directory environment.