detection.wiki

Microsoft-Windows-Security-Auditing › Event 4766

Event ID 4766 — An attempt to add SID History to an account failed.

Provider
Microsoft-Windows-Security-Auditing
Channel
Security
Audit Policy
Account Management → User Account Management
Collection Priority
Recommended (Yamato Security, others)
Opcode
Info

Description

An attempt to add SID History to an account failed.

Message #

An attempt to add SID History to an account failed.

Subject:
	Security ID:
	Account Name: %5
	Account Domain: %6
	Logon ID: %7

Target Account:
	Security ID: %4
	Account Name: %2
	Account Domain: %3

Source Account
	Account Name: %1

Additional Information:
	Privileges: %8

Fields #

NameDescription
Account_Name UnicodeString[Target Account] Account Name.
Account_Name UnicodeString[Target Account] Account Name.
Account_Domain UnicodeString[Target Account] Account Domain.
Security_ID UnicodeString[Target Account] Security ID.
Account_Name UnicodeString[Security ID] Account Name.
Account_Domain UnicodeString[Security ID] Account Domain.
Logon_ID UnicodeString[Security ID] Logon ID.
Privileges UnicodeString[Additional Information] Privileges. Privilege constants reference
SourceUserName UnicodeString[Target Account] Account Name
TargetUserName UnicodeString[Target Account] Account Name
TargetDomainName UnicodeString[Target Account] Account Domain
TargetSid UnicodeString[Target Account] Security ID
SubjectUserName UnicodeString[Security ID] Account Name
SubjectDomainName UnicodeString[Security ID] Account Domain
SubjectLogonId UnicodeString[Security ID] Logon ID
PrivilegeList UnicodeString[Additional Information] Privileges Privilege constants reference

Detection Patterns #

Community Notes #

May indicate DCShadow or similar lateral movement attacks.

References #