RID Hijacking

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This query detects all authentication attempts of non administrator accounts that their RID is ending in *-500. Ref: https://stealthbits.com/blog/rid-hijacking-when-guests-become-admins/

Attribute Value
Type Hunting Query
Solution GitHub Only
ID fcdeec10-6948-11ec-90d6-0242ac120003
Tactics PrivilegeEscalation
Techniques T1078
Required Connectors SecurityEvents
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
SecurityEvent EventID in "4624,4625" ?

Associated Connectors

The following connectors provide data for this content item:

Connector Solution
WindowsSecurityEvents Windows Security Events

Solutions: Windows Security Events


Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Hunting Queries