Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties
Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2025-03-05
- Updated
- 2026-07-31
ATT&CK techniques
Recon → DiscoveryResource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell ScriptBlock content that uses Get-ADComputer-related property lookups aimed at finding systems configured for unconstrained delegation. Attackers can use this information to identify high-value targets for subsequent credential theft and lateral movement. It relies on Script Block Logging telemetry by matching specific AD property and LDAP filter patterns related to delegation settings.
Reporting behind it
- pentestlab.bloghttps://pentestlab.blog/2022/03/21/unconstrained-delegation/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties"
id: 06bd4e31-b3ae-41af-8da9-7f9bf1b89a98
status: experimental
description: This rule flags PowerShell ScriptBlock content that uses Get-ADComputer-related property lookups aimed at finding systems configured for unconstrained delegation. Attackers can use this information to identify high-value targets for subsequent credential theft and lateral movement. It relies on Script Block Logging telemetry by matching specific AD property and LDAP filter patterns related to delegation settings.
references:
- https://pentestlab.blog/2022/03/21/unconstrained-delegation/
- https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery.yml
author: frack113, Huntrule Team
date: 2025-03-05
tags:
- attack.reconnaissance
- attack.discovery
- attack.credential-access
- attack.t1018
- attack.t1558
- attack.t1589.002
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enable"
detection:
selection:
ScriptBlockText|contains:
- -Properties*TrustedForDelegation
- -Properties*TrustedToAuthForDelegation
- -Properties*msDS-AllowedToDelegateTo
- -Properties*PrincipalsAllowedToDelegateToAccount
- -LDAPFilter*(userAccountControl:1.2.840.113556.1.4.803:=524288)
condition: selection
falsepositives:
- Legitimate use of the library for administrative activity
level: medium
license: DRL-1.1
related:
- id: cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5
type: derived