Windows Security: AD user/computer backdoor via msDS-AllowedToDelegateTo and delegation attributes
Alerts on AD delegation-related attribute changes that may create credentialless account control paths.
- Product
- windows
- Service
- security
- Author
- @neu5ron (SigmaHQ), DRL 1.1
- Published
- 2017-04-13
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows Security and directory events that indicate an account can be controlled or impersonated using delegation-related attributes rather than valid credentials. It matches Active Directory changes to msDS-AllowedToDelegateTo and msDS-AllowedToActOnBehalfOfOtherIdentity, as well as related user servicePrincipalName context. It relies on EventID 4738 (user account change) and EventID 5136 (directory object changes) along with the specific attribute names captured in the event telemetry.
Reporting behind it
- msdn.microsoft.comhttps://msdn.microsoft.com/en-us/library/cc220234.aspx
- adsecurity.orghttps://adsecurity.org/?p=3466
- blog.harmj0y.nethttps://blog.harmj0y.net/redteaming/another-word-on-delegation/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security: AD user/computer backdoor via msDS-AllowedToDelegateTo and delegation attributes"
id: b011c347-ef4e-4ef3-8615-5e650ec843ad
status: test
description: This rule identifies Windows Security and directory events that indicate an account can be controlled or impersonated using delegation-related attributes rather than valid credentials. It matches Active Directory changes to msDS-AllowedToDelegateTo and msDS-AllowedToActOnBehalfOfOtherIdentity, as well as related user servicePrincipalName context. It relies on EventID 4738 (user account change) and EventID 5136 (directory object changes) along with the specific attribute names captured in the event telemetry.
references:
- https://msdn.microsoft.com/en-us/library/cc220234.aspx
- https://adsecurity.org/?p=3466
- https://blog.harmj0y.net/redteaming/another-word-on-delegation/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml
author: "@neu5ron, Huntrule Team"
date: 2017-04-13
modified: 2024-02-26
tags:
- attack.privilege-escalation
- attack.t1098
- attack.persistence
logsource:
product: windows
service: security
definition: "Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\DS Access\\Audit Directory Service Changes"
detection:
selection1:
EventID: 4738
filter_empty:
AllowedToDelegateTo:
- ""
- "-"
filter_null:
AllowedToDelegateTo: null
selection_5136_1:
EventID: 5136
AttributeLDAPDisplayName: msDS-AllowedToDelegateTo
selection_5136_2:
EventID: 5136
ObjectClass: user
AttributeLDAPDisplayName: servicePrincipalName
selection_5136_3:
EventID: 5136
AttributeLDAPDisplayName: msDS-AllowedToActOnBehalfOfOtherIdentity
condition: (selection1 and not 1 of filter_*) or 1 of selection_5136_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 300bac00-e041-4ee2-9c36-e262656a6ecc
type: derived