Security Identifiers

SID structure, well-known SIDs, relative versus domain SIDs, and how SID analysis exposes token abuse and lateral movement

SID Structure

A Security Identifier (SID) uniquely identifies a security principal: a user account, group, computer account, or built-in entity. It's a variable-length binary structure with a textual form: S-R-I-SA₁-SA₂-...-SAₙ.

SID binary structure:
  Byte 0:   Revision (always 1)
  Byte 1:   SubAuthorityCount (N, up to 15)
  Bytes 2-7: IdentifierAuthority (6 bytes, big-endian)
  Bytes 8+:  SubAuthority[0..N-1] (each 4 bytes, LE DWORD)

Text form: S-{Revision}-{IdentifierAuthority}-{SA0}-{SA1}-...

Example:
  S-1-5-21-1234567890-987654321-1122334455-1001
    |  |  |            domain sub-authorities           | RID
    |  |  NT Authority (IdentifierAuthority = 5)
    |  Revision = 1
    S = SID prefix

Well-Known SIDs

Domain vs Local SIDs

A domain account SID has the form S-1-5-21-{DA1}-{DA2}-{DA3}-{RID} where DA1/DA2/DA3 are the three sub-authorities that identify the domain (set when the domain was created; the same for all accounts in that domain). The RID is the unique per-account identifier within the domain.

To identify whether a SID belongs to a domain: extract the first three sub-authorities and compare to the domain's own SID. The built-in SYSTEM account (S-1-5-18) has only one sub-authority (18) — there's no domain component. BUILTIN group SIDs use S-1-5-32 as the authority with the group RID as the single sub-authority.

SID APIs

// Look up the account name for any SID
void PrintSidInfo(PSID pSid)
{
    char  name[256]   = {};
    char  domain[256] = {};
    DWORD nameLen     = 256;
    DWORD domainLen   = 256;
    SID_NAME_USE use;
    char *strSid = NULL;

    ConvertSidToStringSidA(pSid, &strSid);
    printf("SID: %s\n", strSid);
    LocalFree(strSid);

    if (LookupAccountSidA(NULL, pSid, name, &nameLen,
                          domain, &domainLen, &use)) {
        const char *useStr[] = {
            "", "User", "Group", "Domain", "Alias",
            "WellKnownGroup", "DeletedAccount", "Invalid",
            "Unknown", "Computer", "Label"
        };
        printf("Name: %s\\%s (%s)\n", domain, name, useStr[use]);
    }
}

// Build a SID from scratch (e.g., S-1-5-18 SYSTEM)
PSID BuildSystemSid()
{
    SID_IDENTIFIER_AUTHORITY ntAuth = SECURITY_NT_AUTHORITY;
    PSID pSid;
    AllocateAndInitializeSid(&ntAuth, 1, SECURITY_LOCAL_SYSTEM_RID,
                              0,0,0,0,0,0,0, &pSid);
    return pSid;  // caller FreeSid()
}

SID Analysis in Detection

# Python: parse SID from a hex string and classify it
import struct, re

def parse_sid(sid_bytes: bytes) -> str:
    rev    = sid_bytes[0]
    count  = sid_bytes[1]
    ia     = int.from_bytes(sid_bytes[2:8], 'big')
    subs   = [struct.unpack_from('<I', sid_bytes, 8 + i*4)[0]
              for i in range(count)]
    return "S-{}-{}-{}".format(rev, ia, "-".join(str(s) for s in subs))

WELL_KNOWN = {
    "S-1-5-18":       "SYSTEM",
    "S-1-5-19":       "Local Service",
    "S-1-5-20":       "Network Service",
    "S-1-1-0":        "Everyone",
    "S-1-5-32-544":   "BUILTIN\\Administrators",
    "S-1-16-12288":   "High IL",
    "S-1-16-8192":    "Medium IL",
    "S-1-16-4096":    "Low IL",
}

def classify_sid(sid_str: str) -> str:
    if sid_str in WELL_KNOWN:
        return WELL_KNOWN[sid_str]
    parts = sid_str.split("-")
    if len(parts) == 8 and parts[2] == "5" and parts[3] == "21":
        rid = int(parts[-1])
        if   rid == 500: return "Built-in Administrator"
        elif rid == 501: return "Guest"
        elif rid >= 1000: return f"Domain User (RID={rid})"
    return "Unknown"

Q & A