RID hijacking is a Windows persistence technique that edits an account's relative identifier (RID), the tail of its security identifier, so a low-privilege account is treated as another, usually the built-in Administrator (RID 500). An attacker with SYSTEM modifies the account's RID in the SAM registry; the account then logs in normally but with administrator privileges, a stealthy backdoor that survives password changes. Defend by protecting SYSTEM access, monitoring SAM changes, and detecting RID anomalies.
What RID hijacking is
Windows decides what an account can do from its security identifier, which ends in a relative identifier (RID); the built-in Administrator is RID 500. RID hijacking rewrites a chosen account's RID in the local SAM so the system treats it as that privileged account. The account keeps its own name and password, so it looks unremarkable while carrying administrator rights.
How the attack works
With SYSTEM on a host the attacker edits the target account's F value in the SAM registry (HKLM\SAM) to set its RID to 500, using a tool such as mimikatz misc::rid or a direct registry edit. The low-privilege or even disabled account can then be used to log in with full administrator privileges. Because the change is in the SAM and survives reboots and password resets, it is durable local persistence. Shown for defensive testing.
How to defend against it
The technique needs SYSTEM, so limit who reaches it and protect the SAM. Monitor for changes to SAM registry keys and for accounts whose effective privileges do not match their expected group membership, and alert on a non-admin account resolving to RID 500. Regular privileged-access reviews catch accounts that quietly gained admin rights.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: Security identifiers(Microsoft)
A quietly hijacked RID can hide an admin backdoor for months. Talk to a security expert about auditing your privileged accounts.