Wiki › Techniques, Tactics & Procedures (TTPs) › Lateral Movement › Active Directory Delegation Abuse

Active Directory Delegation Abuse

2 min read

Jump to:

Overview

Active Directory Delegation Abuse is a technique where adversaries exploit delegated permissions within an Active Directory (AD) environment to escalate privileges, maintain persistence, or move laterally. By abusing delegated rights, attackers can manipulate objects or attributes beyond their intended scope, facilitating unauthorized access and control within the network.

Attack Objective

Gain elevated privileges or maintain persistence through delegated access
Supports stages including Privilege Escalation, Persistence, and Lateral Movement
Advances attacker position by leveraging legitimate permissions to evade detection and expand control

How the Technique Works

Active Directory delegation allows administrators to assign specific permissions on AD objects to users or groups without granting full administrative rights. Adversaries identify and exploit these delegated permissions to perform unauthorized actions such as modifying user attributes, resetting passwords, or creating privileged accounts. This abuse leverages legitimate access controls, making malicious activity harder to detect.

Common Methods & Variations

Exploiting delegated rights to reset passwords or modify group memberships
Abuse of constrained delegation and resource-based constrained delegation in on-premises and hybrid environments
Use of built-in tools and native AD management utilities (living-off-the-land) versus custom scripts or tools

Indicators of Compromise (IOCs)

Unusual changes to AD object permissions or delegation settings in security logs
Unexpected password resets or group membership modifications
Audit logs showing delegation-related modifications or access outside normal administrative workflows

Detection Strategies

Monitoring Active Directory audit logs and Security Event Logs for delegation changes
Behavioral detection focusing on anomalous delegation modifications or privilege escalations
Correlation of delegation changes with other suspicious activities such as account creation or privilege abuse

Mitigation & Prevention

Implement least privilege principles and regularly review delegated permissions
Enforce strong access controls and segmentation within Active Directory
Use role-based access control (RBAC) and monitor delegation assignments continuously

Response Considerations

Immediately revoke or restrict suspicious delegated permissions
Conduct thorough investigation of delegation changes and associated account activities
Harden delegation configurations and audit policies post-incident to prevent recurrence

Related Techniques

Credential Access via Password Reset Abuse
Privilege Escalation through Group Membership Modification
Lateral Movement using Pass-the-Hash or Pass-the-Ticket

Mapping & References

MITRE ATT&CK Tactic: Privilege Escalation, Persistence, Lateral Movement
MITRE ATT&CK Technique: T1098 – Account Manipulation
Public research on Active Directory delegation abuse and detection best practices

Tags: Access Control Active Directory Attack Techniques Cybersecurity Delegation Abuse Identity Security lateral movement persistence privilege escalation Threat Detection