SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Identity, authentication and credential attacks

Constrained delegation / S4U abuse

S4U2Self/S4U2Proxy on delegation accounts impersonate users to services

categoryIdentity, authentication and credential attacksseverityHighdetectabilityHighlabnot yet measured

Classification

24 values: 10 imported, 1 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	High
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Established

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	LinuxmacOSWindows
Environment	On-premises
Target asset class	Identity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Active Directory Credential RequestFile AccessLogon Session MetadataProcess Access

Detection & response

Mitigated by 27

M1015 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1041 attack-mitigation
M1043 attack-mitigation
M1047 attack-mitigation
D3-ANCI d3fend
D3-APCA d3fend
D3-CCSA d3fend
D3-CH d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CSPP d3fend
D3-CTS d3fend
D3-DUC d3fend
D3-MFA d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RIC d3fend
D3-RTA d3fend
D3-RTSD d3fend
D3-TB d3fend
D3-TBA d3fend
D3-UGLPA d3fend

Detected by 27

DET0522 attack-detection-strategy
12827a56-61a4-476a-a9cb-f3068f191073 sigma
12e6d621-194f-4f59-90cc-1959e21e69f7 sigma
1eeed653-dbc8-4187-ad0c-eeebb20e6599 sigma
3245cd30-e015-40ff-a31d-5cadd5f377ec sigma
44bbff3e-4ca3-452d-a49a-6efa4cafa06f sigma
496a0e47-0a33-4dca-b009-9e6ca3591f39 sigma
503fe26e-b5f2-4944-a126-eab405cc06e5 sigma
5a44727c-3b85-4713-8c44-4401d5499629 sigma
6daac7fc-77d1-449a-a71a-e6b4d59a0e54 sigma
78cc2dd2-7d20-4d32-93ff-057084c38b93 sigma
7ec2c172-dceb-4c10-92c9-87c1881b7e18 sigma
94309181-d345-4cbf-b5fe-061769bdf9cb sigma
9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523 sigma
9e099d99-44c2-42b6-a6d8-54c3545cab29 sigma
a7664b14-75fb-4a50-a223-cb9bc0afbacf sigma
a861d835-af37-4930-bcd6-5b178bfb54df sigma
b1e0b3f5-b62e-41be-886a-daffde446ad4 sigma
b2e4a719-3c8f-4d1b-a507-f83c2d56e901 sigma
caa9a802-8bd8-4b9e-a5cd-4d6221670219 sigma
cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5 sigma
d04ae2b8-ad54-4de0-bd87-4bc1da66aa59 sigma
e3f7c841-2a9d-4b5e-c018-d94b3e67f012 sigma
e54979bd-c5f9-4d6c-967b-a04b19ac4c74 sigma
e80a0fee-1a62-4419-b31e-0d0db6e6013a sigma
e96253b8-6b3b-4f90-9e59-3b24b99cf9b4 sigma
eca91c7c-9214-47b9-b4c5-cb1d7e4f2350 sigma

Tested by 13

14625569-6def-4497-99ac-8e7817105b55 atomic
29094950-2c96-4cbd-b5e4-f7c65079678f atomic
385e59aa-113e-4711-84d9-f637aef01f2c atomic
3f987809-3681-43c8-bcd8-b3ff3a28533a atomic
615bd568-2859-41b5-9aed-61f6a88e48dd atomic
78d10e20-c874-45f2-a9df-6fea0120ec27 atomic
8c385f88-4d47-4c9a-814d-93d9deec8c71 atomic
902f4ed2-1aba-4133-90f2-cff6d299d6da atomic
9726592a-dabc-4d4d-81cd-44070008b3af atomic
988539bc-2ed7-4e62-aec6-7c5cf6680863 atomic
d6139549-7b72-4e48-9ea1-324fc9bdf88a atomic
e42d33cd-205c-4acf-ab59-a9f38f6bad9c atomic
e6f4affd-d826-4871-9a62-6c9004b8fe06 atomic

Attack relationships

Framework references

Primary source: https://eladshamir.com/2019/01/28/Wagging-the-Dog.html
attack: T1558 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 362 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1558 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 2 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)