mdecrevoisier high experimental sigma

Computer account manipulation for delegation (RBCD)

Detects scenarios where an attacker manipulate a computer object and updates its attribute 'msDS-AllowedToActOnBehalfOfOtherIdentity' to enable a resource to impersonate and authenticate any domain user.

View Source

Detection Logic

{
  "selection": {
    "EventID": 5136,
    "DSType": "%%14676",
    "ObjectClass": "computer",
    "AttributeLDAPDisplayName": "msDS-AllowedToActOnBehalfOfOtherIdentity"
  },
  "condition": "selection"
}

False Positives

⚠ Computer account set for delegation by a sysadmin

Field Validations

Loading…

Comments (0)

Loading comments...