Active Directory User Account Delegation Backdoor

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•50

This rule detects modifications to Active Directory user accounts that could enable an attacker to control another user's or computer's account without needing their credentials. Specifically, it looks for changes to attributes related to delegation, such as 'msDS-AllowedToDelegateTo' and 'msDS-AllowedToActOnBehalfOfOtherIdentity', or the 'servicePrincipalName' attribute for user objects, which can be abused for Kerberoasting or other delegation attacks. Event ID 4738 indicates a user account was changed, and Event ID 5136 indicates a directory service object was modified.