Detection of Unconstrained Delegation Discovery via PowerShell

This threat brief identifies reconnaissance activity targeting Active Directory configurations. Attackers leverage the Get-ADComputer cmdlet to scan for machines with specific attributes that indicate unconstrained delegation. Unconstrained delegation allows a server to impersonate a domain user to any other service in the forest, making these systems high-value targets for attackers seeking to escalate privileges or move laterally through the domain. By identifying these computers, an attacker can plan credential harvesting operations, such as capturing TGTs from a compromised service account. Defenders should monitor PowerShell Script Block logs for queries specifically filtering for delegation-related LDAP flags or properties. This activity is a common precursor to advanced lateral movement and credential access techniques in Windows environments.

Attack Chain

1. Attacker establishes initial access on a domain-joined machine.
2. Attacker loads the ActiveDirectory PowerShell module.
3. Attacker executes Get-ADComputer with flags to query TrustedForDelegation properties.
4. Attacker parses output to identify specific high-value targets.
5. Attacker attempts to compromise the identified service account or host.
6. Attacker harvests credentials or impersonates users via the delegation vulnerability.
7. Attacker proceeds to lateral movement or further domain privilege escalation.

Impact

Successful discovery leads to the identification of critical infrastructure in a Windows domain environment. If exploited, attackers can gain the ability to impersonate domain users, leading to widespread unauthorized access, privilege escalation, and potential full domain compromise.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) across all domain-joined Windows endpoints.
• Deploy the provided Sigma rule to detect suspicious Get-ADComputer cmdlet usage focused on delegation properties.
• Audit high-privilege service accounts and limit the use of unconstrained delegation where not strictly required by application architecture.