Rubeus Kerberos constrained delegation abuse (S4U2Proxy)

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker abuse Kerberos constrained delegation in order to escalate privileges.

Known false positives

Accounts with constrained delegation enabled

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1558` Steal or Forge Kerberos Tickets

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4769: A Kerberos service ticket was requested.

Rule body

title: Rubeus Kerberos constrained delegation abuse (S4U2Proxy)
description: Detects scenarios where an attacker abuse Kerberos constrained delegation in order to escalate privileges.
references:
- https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/
- https://www.harmj0y.net/blog/activedirectory/s4u2pwnage/
- https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-kerberos-constrained-delegation
- https://www.guidepointsecurity.com/delegating-like-a-boss-abusing-kerberos-delegation-in-active-directory/
- https://stealthbits.com/blog/what-is-kerberos-delegation-an-overview-of-kerberos-delegation/
- https://www.thehacker.recipes/ad/movement/kerberos/delegations#talk
tags:
- attack.credential_access
- attack.t1558
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TransmittedServices|contains: '@'
  filter:
    - ServiceSid|endswith: '-502' # Krbtgt account SID is excluded as it may be related to "Unconstrained Domain Persistence" (see other rule)
    - TargetUserName: '%allowed_S4U2Proxy_accounts%' # User accounts allowed to perform constrained delegation
    - IpAddress: '%domain_controllers_ips%'          # reduce amount of false positives
  condition: selection and not filter
falsepositives:
- Accounts with constrained delegation enabled
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 4769
  TransmittedServices|contains: '@'

Stage 2: `not filter`

filter:
  - ServiceSid|endswith: '-502'
  - TargetUserName: '%allowed_S4U2Proxy_accounts%'
  - IpAddress: '%domain_controllers_ips%'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`IpAddress`	eq	`%domain_controllers_ips%`	`excludes:IpAddress` `field:"IpAddress" value:"%domain_controllers_ips%"`
`ServiceSid`	ends_with	`-502`	`excludes:ServiceSid` `field:"ServiceSid" value:"-502"`
`TargetUserName`	eq	`%allowed_S4U2Proxy_accounts%`	`excludes:TargetUserName` `field:"TargetUserName" value:"%allowed_S4U2Proxy_accounts%"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TransmittedServices`	match	`@` corpus 2 (sigma 2)	`field:"TransmittedServices" kind:match value:"@"`