SID history lets the attacker claim membership in groups that belong to another domain, so the forged ticket does more than impersonate an account. It imports authority. That widens the blast radius from one domain to the trust chain, especially when the receiving domain does not quarantine the extra SID.
Why SID History Makes Golden Tickets More Dangerous
golden ticket attack are already severe because the attacker can forge Kerberos tickets with domain-level authority. sid history makes the problem worse by adding inherited identity claims from another domain or trust relationship, so the forged ticket is not limited to one principal’s apparent rights. That means the attacker can present a ticket that looks normal on the surface while carrying extra authorization context that many environments fail to inspect closely.
The practical danger is not just broader access, but broader trust. In environments where legacy trusts, poorly scoped domain migrations, or incomplete SID filtering still exist, the injected SID can be treated as legitimate group membership rather than a foreign claim. That creates a path from one compromised domain context into another, and it can turn a single forged Kerberos artifact into a cross-domain privilege problem. MITRE ATT&CK Enterprise Matrix captures the broader adversary tradecraft around Kerberos ticket abuse, while NHI Management Group’s guidance on secret and identity sprawl helps explain why these abuses persist once trust boundaries are weak. In practice, many defenders discover the SID history problem only after access has already crossed a boundary that they assumed was quarantined.
How SID History Changes the Mechanics of Forged Ticket Abuse
SID history is designed to preserve access during migrations by carrying prior security identifiers forward. In a clean migration, that reduces disruption. In an attack, the same feature becomes a force multiplier because the attacker can embed historical SIDs into a forged ticket and ask the receiving domain to honor claims that originated elsewhere. The key issue is that Kerberos validates ticket structure and cryptographic authenticity, but authorization still depends on how the target domain interprets the SIDs inside the ticket.
When SID filtering is absent, incomplete, or bypassed through trust misconfiguration, the receiving domain may accept the extra SID as if it were a valid entitlement. That can let the attacker reach resources through group-based authorization paths that were never intended to be available to the compromised account. The result is often better than direct impersonation: the forged ticket can blend into expected group membership patterns, making privilege expansion harder to spot in routine monitoring. For a governance baseline on identity and access trust boundaries, see NIST guidance on security controls and authentication assumptions in NIST SP 800-53 Rev 5 Security and Privacy Controls.
- Without SID filtering, the ticket can carry authority across trust boundaries.
- With legacy trusts, migration remnants can become an attacker’s cover for cross-domain access.
- With poor monitoring, the added SID looks like ordinary group membership rather than injected privilege.
NHIMG’s research on NHI compromise underscores the same pattern of long-lived identity artifacts becoming durable access paths, especially when organisations lack full visibility into what is still trusted and why. The attack becomes more severe because the ticket stops being a single-domain forgery and starts behaving like a portable authorization package. These controls tend to break down when domains are still connected by legacy trust relationships and administrators assume SID history is harmless migration residue.
Where the Risk Spikes in Real Environments
Tighter trust control often increases operational overhead, requiring organisations to balance migration flexibility against authorization integrity. The most exposed environments are usually not the newest ones, but the ones carrying older domain trust patterns, partial mergers, or long migration tails where SID history was left in place for convenience. In those settings, the attacker benefits from ambiguity: defenders may know a SID exists, but not whether it should still be honored in a given trust path.
There is also a common interpretation gap. Teams sometimes think of SID history as a directory hygiene issue, when in fact it is an authorization boundary issue. If the receiving domain does not quarantine foreign SIDs, then the ticket can import privileges that exceed the apparent account identity. That matters most where high-value administrative groups, file shares, remote access paths, or application roles are mapped through group membership rather than direct account controls. Best practice is evolving, but current guidance consistently favors minimizing inherited trust, validating cross-domain claims, and removing historical entitlements once migration need has passed.
Ultimate Guide to NHIs — Key Challenges and Risks is useful here because it frames how lingering identity authority, once created, tends to outlive the original operational justification. In practice, the severe cases appear when defenders rely on the ticket’s cryptographic validity and overlook the authority expansion hidden inside SID history.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC | SID history changes authorization scope across trust boundaries. |
| Recommendation: Treat cross-domain claims as governed access, not inherited entitlement. | ||
| NIST Zero Trust (SP 800-207) | 5 | Cross-domain trust should be explicitly evaluated, not implicitly accepted. |
| Recommendation: Enforce per-request trust validation before honoring extended identity claims. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 | Forged tickets are identity artifacts whose authority can persist and spread. |
| Recommendation: Limit lingering identity authority and remove obsolete trust assumptions. | ||
