Threat Hunting Exercise: Analyzing Windows Unconstrained Kerberos Delegation Abuse Dataset
This hunt uses a simulated Active Directory event dataset (win_security_unconstrained_deleg_2022-09-05T130000.json) capturing T1187 / T1550 (Sub-technique: Unconstrained Delegation Abuse), where an attacker coerces a privileged account (e.g., a Domain Controller or Domain Admin) into authenticating to a server configured for unconstrained delegation, then extracts the cached TGT for full domain compromise.
Step 1: Hypothesis Formation
Hypothesis: A server with the TRUSTED_FOR_DELEGATION flag receives an unexpected authentication from a Domain Controller or high-privilege account shortly after a coercion attempt (e.g., PrinterBug/PetitPotam-style RPC calls), and that server's LSASS cache is subsequently accessed by a non-system process - indicating TGT extraction from delegation abuse. Indicators:
- Anomalous inbound SMB/RPC authentication from a Domain Controller machine account to a non-DC server configured for unconstrained delegation.
- MS-RPRN or MS-EFSR RPC calls (PrinterBug/PetitPotam coercion signatures) originating from the attacker host targeting the DC just prior.
- LSASS access (Sysmon 10,
GrantedAccessmatching credential-dump patterns) on the delegation-enabled server within minutes of the DC authentication. - Subsequent 4768/4769 activity showing the DC's own machine-account TGT being reused elsewhere.
Null Hypothesis: The DC-to-server authentication is a legitimate scheduled backup or monitoring job that has always authenticated to this delegation-enabled host. Invalidate by checking scheduled task/service inventories and confirming no coercion RPC calls preceded the authentication.
Rationale: Unconstrained delegation is one of the most severe AD misconfigurations; combined with coercion techniques it allows full domain compromise without any password or hash theft, so early detection at the coercion or LSASS-access stage is critical.
Step 2: Data Sources and Scope
- Sources: Domain Controller Security logs (4624, 4768, 4769); RPC/SMB session logs on the DC; Sysmon Event ID 1 and 10 on the delegation-enabled server.
- Scope: ~2022-09-05T13:00:00-13:40:00 UTC; Attacker host: WKS-RED-021 (10.60.4.18); Delegation server: APP-SRV07 (10.60.2.9); DC: DC01.
- SIEM Queries (Splunk/ELK):
- Coercion signature:
index=network dest_ip="10.60.2.5" (rpc_call="RpcOpenPrinter" OR rpc_call="EfsRpcOpenFileRaw") - Unexpected DC auth:
index=wineventlog EventCode=4624 Workstation_Name="DC01" dest_host="APP-SRV07" - LSASS access on delegation host:
index=sysmon EventCode=10 TargetImage="lsass.exe" host="APP-SRV07"
Step 3: Key Findings
Parsed events (5 shown) confirm WKS-RED-021 issued a PetitPotam-style coercion call against DC01, forcing it to authenticate to the unconstrained-delegation host APP-SRV07, where LSASS was immediately accessed to extract the DC's TGT.
| Timestamp (UTC) | Host | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-09-05 13:10:02 | DC01 | RPC (MS-EFSR) inbound | EfsRpcOpenFileRaw call from 10.60.4.18 targeting \\DC01\ UNC path | Coercion IOC: EfsRpcOpenFileRaw is the signature PetitPotam call used to force NTLM/Kerberos authentication from a target machine. |
| 2022-09-05 13:10:05 | APP-SRV07 | 4624 (Logon) | Account DC01$ authenticated via Kerberos from 10.60.4.5 (DC01) | Delegation-Trigger IOC: the DC machine account authenticating to an application server it has no operational relationship with, immediately following the coercion call. |
| 2022-09-05 13:10:09 | APP-SRV07 | Sysmon Event ID 10 | Unsigned process rubeus.exe opened LSASS with GrantedAccess: 0x1410 | Credential-Theft IOC: this access mask is consistent with ticket/credential extraction tooling reading LSASS memory. |
| 2022-09-05 13:11:30 | DC01 | 4769 (Service Ticket) | DC01$ machine-account ticket used to request a service ticket for LDAP/DC01 from source IP 10.60.4.18 | Golden-Ticket-Precursor IOC: the extracted DC machine-account TGT is being replayed from the attacker's own host, not from APP-SRV07 or DC01 itself. |
| - | APP-SRV07 | (AD config check) | userAccountControl for APP-SRV07$ includes TRUSTED_FOR_DELEGATION with no constraints (unconstrained delegation) | Confirms the server was configured to cache and forward any TGT it receives - the root misconfiguration enabling this chain. |
Validation:
- Timeline: coercion call → forced DC authentication → LSASS TGT extraction → replay from attacker infrastructure, all within 90 seconds - matches the documented PetitPotam-to-unconstrained-delegation attack chain.
- False Positives: no scheduled task or monitoring agent explains the DC's authentication to APP-SRV07; the RPC call is a known coercion primitive with no legitimate business use on this host pairing.
- Correlation: RPC coercion, unexpected privileged authentication, LSASS access, and ticket replay together confirm domain-wide compromise potential.
Step 4: Recommendations & Next Steps
- Immediate Response: Reset the DC01 machine account password (
krbtgtif further compromise is suspected), remove unconstrained delegation from APP-SRV07 in favor of constrained/resource-based delegation, isolate WKS-RED-021, and hunt for any subsequent DCSync or Golden Ticket activity. - Detection: Sigma-style rule:
title: Coercion-to-Unconstrained-Delegation Chain→selection1: rpc_call IN (EfsRpcOpenFileRaw, RpcOpenPrinter)selection2: EventID=4624 Account_Name endswith "$" dest_host=delegation_enabled_hosts within 5m of selection1→condition: selection1 and selection2. - Pro Tip: Maintain a living inventory of every account/computer object flagged
TRUSTED_FOR_DELEGATION(unconstrained) via a scheduled LDAP query - this list should be near-empty in a modern AD environment, and any DC authentication event landing on one of these hosts warrants immediate investigation regardless of other signals.
Hypothesis confirmed - an attacker used a PetitPotam-style coercion call to force the Domain Controller to authenticate to an unconstrained-delegation server, then extracted its TGT from LSASS, achieving domain-compromise-level access!