{"id":"cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5","title":"Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock","description":"Detects the use of the \"Get-ADComputer\" cmdlet in order to identify systems which are configured for unconstrained delegation.","author":"frack113","status":"experimental","level":"medium","date":"2025-03-05","modified":"","tags":["attack.reconnaissance","attack.discovery","attack.credential-access","attack.t1018","attack.t1558","attack.t1589.002"],"technique_ids":["T1018","T1558","T1589.002"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enable"},"falsepositives":["Legitimate use of the library for administrative activity"],"references":["https://pentestlab.blog/2022/03/21/unconstrained-delegation/","https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery.yml","source_sha256":"a1ef22b7df711dbdaf385e5766973dfec78d49162932618a09083940c752f565","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock\nid: cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5\nstatus: experimental\ndescription: Detects the use of the \"Get-ADComputer\" cmdlet in order to identify systems which are configured for unconstrained delegation.\nreferences:\n    - https://pentestlab.blog/2022/03/21/unconstrained-delegation/\n    - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps\nauthor: frack113\ndate: 2025-03-05\ntags:\n    - attack.reconnaissance\n    - attack.discovery\n    - attack.credential-access\n    - attack.t1018\n    - attack.t1558\n    - attack.t1589.002\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enable'\ndetection:\n    selection:\n        ScriptBlockText|contains:\n            - '-Properties*TrustedForDelegation'\n            - '-Properties*TrustedToAuthForDelegation'\n            - '-Properties*msDS-AllowedToDelegateTo'\n            - '-Properties*PrincipalsAllowedToDelegateToAccount'\n            - '-LDAPFilter*(userAccountControl:1.2.840.113556.1.4.803:=524288)'\n    condition: selection\nfalsepositives:\n    - Legitimate use of the library for administrative activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","page":"techniques/enterprise/T1018/"},{"key":"enterprise/T1558","id":"T1558","name":"Steal or Forge Kerberos Tickets","page":"techniques/enterprise/T1558/"},{"key":"enterprise/T1589.002","id":"T1589.002","name":"Email Addresses","page":"techniques/enterprise/T1589.002/"}],"data_path":"data/detection-rules/cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5.json","kind":"sigma"}