Windows Event ID 4765: SID History was added to an account
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 4765 records addition of SID History to an account, a rare operation with significant privilege implications.
Technical Metadata
| Event ID | 4765 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0004 Privilege Escalation / T1134.005 Access Token Manipulation: SID-History Injection |
| Key fields to watch | Target Account, SID History, Subject |
Trigger Scenarios
A domain controller logs the event when an SID is added to the sIDHistory attribute of an account, typically during approved domain migration.
Key Fields
Target Account
The account receiving SID History. Resolve its current domain role and group memberships.
SID History
The historical SID added to the account. A privileged SID can grant inherited access across resources.
Subject
The account performing the modification. This should normally be a controlled migration process.
Threat Hunting Queries
SecurityEvent
| where EventID == 4765
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4765
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4765- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4765
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4765
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| SidHistory | RID 512 | The relative identifier 512 denotes the Domain Admins group in a domain SID. | Adding a SID ending in -512 can grant access evaluated through Domain Admins without current group membership and must be tied to an approved migration. Source |
| SidHistory | RID 519 | The relative identifier 519 denotes the Enterprise Admins group in the forest-root domain. | A SID ending in -519 carries forest-wide privilege implications and is critical unless explicitly authorized for migration. Source |
MITRE ATT&CK Mapping
- T1134.005Access Token Manipulation: SID-History Injection
Detection Notes
T1134.005 SID-History Injection is high impact when SidHistory ends in RID 512 for Domain Admins or RID 519 for Enterprise Admins. Those SIDs can satisfy authorization checks without current group membership; validate the migration ticket and correlate the target account with subsequent 4624 logons in a window=60 minutes.
Common False Positives
- Approved Active Directory migration projects legitimately add SID History.
- Test migrations can generate the event in lab or staging domains.
Related Events
Sample Log
Subject: CORP\migration.service
Target Account: CORP\jsmith
SID History: S-1-5-21-REDACTED-512Frequently Asked Questions
What does Windows Event ID 4765 mean?
Event ID 4765 records that SID History was added to an account and identifies the actor, target account, and added SID.
Is SID History always malicious?
No. It supports access continuity during legitimate account and domain migrations, but unapproved additions can preserve privileges outside normal group membership.
Why are RID 512 and RID 519 important in SID History?
They identify Domain Admins and Enterprise Admins respectively when appended to the relevant domain SID, so their addition can confer highly privileged authorization through SID History.
Sources
- 4765: Microsoft Windows security auditing event reference
Microsoft · vendor
- Security identifiers
Microsoft · vendor
- Access Token Manipulation: SID-History Injection (T1134.005)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule