Privilege Escalation Folder Templates

The Privilege Escalation folder contains the following templates:

Template	Description	TAGS
AD: Administrator Escalation	Indicates that an unprivileged account has had its ACLs changed to a value that allows it to obtain administrative privileges (directly or transitively).	NEW 5.1 TEMPLATES Privileged Accounts Privilege Escalation AD Security Unauthorized changes
AD: Modifications of Administrator Accounts	Uses the built-in Administrator Accounts – Objects Collection. Add accounts with administrative rights to this collection	NEW 5.1 TEMPLATES Privileged Accounts Privilege Escalation AD Security Unauthorized changes
AD: SID History Tampering	SID History is an attribute that supports migration scenarios. Each user account has an associated Security Identifier (SID) that tracks the security principal and the access the account has when connecting to resources. SID History allows one account to effectively replicate another's access. This proves useful for retaining user access when moving accounts from one domain to another. Since the user's SID changes when you create the new account, the old SID must map to the new one. When you migrate a user from Domain A to Domain B, you create a new user account in Domain B and add the Domain A user's SID to Domain B's user account's SID History attribute. This ensures the Domain B user can access resources in Domain A. To detect SID History account escalation, this policy monitors users with data in the SID History attribute and flags those with SIDs in the same domain that have changed	NEW 5.1 TEMPLATES Privileged Accounts Privilege Escalation Persistence AD Security Unauthorized changes
Ntds.dit File Hijacking	Protects users from stealing Ntds.dit file which contains the Active Directory database. Attackers can use Volume Shadow Copy to copy this file, but this will prevent and log any activity based on configuration.	NEW 5.2 TEMPLATES Privileged Accounts Privilege Escalation Persistence AD Security Unauthorized changes