What is RID hijacking and how does it differ from account cloning?
RID hijacking is a privilege escalation technique that modifies the Relative Identifier (RID) portion of an account's Security Identifier (SID) in the Windows registry, allowing a low-privilege account to inherit the permissions of another account. Unlike account cloning, which copies the entire F key registry entry, RID hijacking overwrites only the RID values at offsets 0x30f and 0x31f in the target account's F key, granting the same privileges upon next login.
RID hijackingaccount cloningWindows privilege escalationSIDregistry modification