Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock — Sigma Rule

Rule metadata and linked tags

Author: frack113. Source status: experimental; severity: medium. Source dates: 2025-03-05 / not supplied.

{
  "product": "windows",
  "category": "ps_script",
  "definition": "Requirements: Script Block Logging must be enable"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: a1ef22b7df711dbdaf385e5766973dfec78d49162932618a09083940c752f565

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
id: cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5
status: experimental
description: Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.
references:
    - https://pentestlab.blog/2022/03/21/unconstrained-delegation/
    - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps
author: frack113
date: 2025-03-05
tags:
    - attack.reconnaissance
    - attack.discovery
    - attack.credential-access
    - attack.t1018
    - attack.t1558
    - attack.t1589.002
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enable'
detection:
    selection:
        ScriptBlockText|contains:
            - '-Properties*TrustedForDelegation'
            - '-Properties*TrustedToAuthForDelegation'
            - '-Properties*msDS-AllowedToDelegateTo'
            - '-Properties*PrincipalsAllowedToDelegateToAccount'
            - '-LDAPFilter*(userAccountControl:1.2.840.113556.1.4.803:=524288)'
    condition: selection
falsepositives:
    - Legitimate use of the library for administrative activity
level: medium

Original YAML and metadata in JSON

False positives

• Legitimate use of the library for administrative activity

Source references

• https://pentestlab.blog/2022/03/21/unconstrained-delegation/
• https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps