{"id":"311b6ce2-7890-4383-a8c2-663a9f6b43cd","title":"Enabled User Right in AD to Control User Objects","description":"Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.","author":"@neu5ron","status":"test","level":"high","date":"2017-07-30","modified":"2021-12-02","tags":["attack.privilege-escalation","attack.persistence","attack.t1098"],"technique_ids":["T1098"],"logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Policy : Policy Change > Audit Authorization Policy Change, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Policy Change\\Audit Authorization Policy Change"},"falsepositives":["Unknown"],"references":["https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/"],"source_path":"rules/windows/builtin/security/win_security_alert_active_directory_user_control.yml","source_sha256":"e7e8b5f5feb004a016b90067fbf6e176d8b0fcfe7812d2fccf05ec1166f6d7f7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_alert_active_directory_user_control.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Enabled User Right in AD to Control User Objects\nid: 311b6ce2-7890-4383-a8c2-663a9f6b43cd\nstatus: test\ndescription: Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.\nreferences:\n    - https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/\nauthor: '@neu5ron'\ndate: 2017-07-30\nmodified: 2021-12-02\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1098\nlogsource:\n    product: windows\n    service: security\n    definition: 'Requirements: Audit Policy : Policy Change > Audit Authorization Policy Change, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Policy Change\\Audit Authorization Policy Change'\ndetection:\n    selection_base:\n        EventID: 4704\n    selection_keywords:\n        PrivilegeList|contains: 'SeEnableDelegationPrivilege'\n    condition: all of selection*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","page":"techniques/enterprise/T1098/"}],"data_path":"data/detection-rules/311b6ce2-7890-4383-a8c2-663a9f6b43cd.json","kind":"sigma"}