Skip to content

Hide Navigation Hide TOC

Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock (cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5)

Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.

Cluster A Galaxy A Cluster B Galaxy B Level
Email Addresses - T1589.002 (69f897fd-12a9-4c89-ad6a-46d2f3c38262) Attack Pattern Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock (cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5) Sigma-Rules 1
Remote System Discovery - T1018 (e358d692-23c0-4a31-9eb6-ecc13a8d7735) Attack Pattern Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock (cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5) Sigma-Rules 1
Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock (cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5) Sigma-Rules Steal or Forge Kerberos Tickets - T1558 (3fc01293-ef5e-41c6-86ce-61f10706b64a) Attack Pattern 1
Email Addresses - T1589.002 (69f897fd-12a9-4c89-ad6a-46d2f3c38262) Attack Pattern Gather Victim Identity Information - T1589 (5282dd9a-d26d-4e16-88b7-7c0f4553daf4) Attack Pattern 2