What is RID hijacking and how does it differ from account cloning?

RID hijacking is a privilege escalation technique that modifies the Relative Identifier (RID) portion of an account's Security Identifier (SID) in the Windows registry, allowing a low-privilege account to inherit the permissions of another account. Unlike [account cloning](/news/penetration-techniques-account-hiding-in-windows-systems), which copies the entire F key registry entry, RID hijacking overwrites only the RID values at offsets 0x30f and 0x31f in the target account's F key, granting the same privileges upon next login.