ExtraSIDs
ABOUT
ExtraSIDs is a technique where a forged Kerberos ticket (Golden Ticket) includes additional SIDs, typically from a more privileged domain like the parent domain in a forest, allowing an attacker who compromised a child domain to impersonate membership in high-privilege groups such as Enterprise Admins and gain unauthorized access across domain boundaries, bypassing normal group membership checks if SID filtering is not enforced.