PowerShell Unconstrained Delegation Discovery via Get-ADComputer Script Block

Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.

FreeUnreviewedSigmamediumv1

powershell-unconstrained-delegation-discovery-via-get-adcomputer-script-block-cdfa73b6

title: PowerShell Unconstrained Delegation Discovery via Get-ADComputer Script Block
id: 06bd4e31-b3ae-41af-8da9-7f9bf1b89a98
status: experimental
description: This rule identifies PowerShell script blocks that use Get-ADComputer-related queries to enumerate Active Directory attributes associated with unconstrained delegation and related delegation controls. Attackers often perform this reconnaissance to locate domain assets that could enable credential interception or escalation pathways. It relies on Script Block Logging telemetry capturing the script text and matching specific parameter/property patterns used in the queries.
references:
  - https://pentestlab.blog/2022/03/21/unconstrained-delegation/
  - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery.yml
author: frack113, Huntrule Team
date: 2025-03-05
tags:
  - attack.reconnaissance
  - attack.discovery
  - attack.credential-access
  - attack.t1018
  - attack.t1558
  - attack.t1589.002
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enable"
detection:
  selection:
    ScriptBlockText|contains:
      - -Properties*TrustedForDelegation
      - -Properties*TrustedToAuthForDelegation
      - -Properties*msDS-AllowedToDelegateTo
      - -Properties*PrincipalsAllowedToDelegateToAccount
      - -LDAPFilter*(userAccountControl:1.2.840.113556.1.4.803:=524288)
  condition: selection
falsepositives:
  - Legitimate use of the library for administrative activity
level: medium
license: DRL-1.1
related:
  - id: cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5
    type: derived

What it detects

This rule identifies PowerShell script blocks that use Get-ADComputer-related queries to enumerate Active Directory attributes associated with unconstrained delegation and related delegation controls. Attackers often perform this reconnaissance to locate domain assets that could enable credential interception or escalation pathways. It relies on Script Block Logging telemetry capturing the script text and matching specific parameter/property patterns used in the queries.

Known false positives

Legitimate use of the library for administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.