RID Hijacking

RID (Relative ID part of security identifier) hijacking allows an attacker with SYSTEM level privileges to covertly replace the RID of a low privileged account effectively making the low privileged account assume Administrator privileges on the next logon.

• Platform: Windows
• Severity: High
• MITRE Tactic: Persistence
• MITRE Techniques: T1547

Back to all rules