Sigma rule: Active Directory User Backdoors

Rule

Title

Active Directory User Backdoors

Status

test

Level

high

Author

@neu5ron

Date

2017-04-13

Modified

2024-02-26

File

rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects scenarios where one can control another users or computers account without having to use their credentials.

Log source

product

windows

service

security

definition

Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes

Detection

selection1:
    EventID: 4738
filter_empty:
    AllowedToDelegateTo:
        - ''
        - '-'
filter_null:
    AllowedToDelegateTo: null
selection_5136_1:
    EventID: 5136
    AttributeLDAPDisplayName: 'msDS-AllowedToDelegateTo'
selection_5136_2:
    EventID: 5136
    ObjectClass: 'user'
    AttributeLDAPDisplayName: 'servicePrincipalName'
selection_5136_3:
    EventID: 5136
    AttributeLDAPDisplayName: 'msDS-AllowedToActOnBehalfOfOtherIdentity'
condition: (selection1 and not 1 of filter_*) or 1 of selection_5136_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.t1098
• attack.persistence

MITRE ATT&CK ids this rule names

• T1098

References

• https://msdn.microsoft.com/en-us/library/cc220234.aspx
• https://adsecurity.org/?p=3466
• https://blog.harmj0y.net/redteaming/another-word-on-delegation/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml