Unconstrained delegation abuse

A DC coerced to a host with unconstrained delegation, then its TGT harvested

categoryIdentity, authentication and credential attacksseverityVery HighdetectabilityHighlabnot yet measured

Example: Printer bug

Classification

28 values: 14 imported, 1 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	High
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Established

Impact & scope

Severity	Very High
Impact	ConfidentialityIntegrity
Platform	LinuxmacOSWindows
Environment	On-premises
Target asset class	Identity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Active Directory Credential RequestFile AccessFile CreationFile ModificationLogon Session MetadataNetwork Traffic ContentNetwork Traffic FlowProcess Access

Detection & response

Mitigated by 41

M1015 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1037 attack-mitigation
M1041 attack-mitigation
M1043 attack-mitigation
M1047 attack-mitigation
D3-AEM d3fend
D3-ANCI d3fend
D3-APCA d3fend
D3-CCSA d3fend
D3-CF d3fend
D3-CH d3fend
D3-CM d3fend
D3-CQ d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CSPP d3fend
D3-CTS d3fend
D3-DF d3fend
D3-DUC d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-MFA d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-OPM d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-RIC d3fend
D3-RTA d3fend
D3-RTSD d3fend
D3-TB d3fend
D3-TBA d3fend
… and 1 more in the database

Detected by 37

DET0022 attack-detection-strategy
DET0522 attack-detection-strategy
0ed99dda-6a35-11ef-8c99-0242ac120002 sigma
12827a56-61a4-476a-a9cb-f3068f191073 sigma
12e6d621-194f-4f59-90cc-1959e21e69f7 sigma
1ce8c8a3-2723-48ed-8246-906ac91061a6 sigma
1eeed653-dbc8-4187-ad0c-eeebb20e6599 sigma
3245cd30-e015-40ff-a31d-5cadd5f377ec sigma
4096842a-8f9f-4d36-92b4-d0b2a62f9b2a sigma
44bbff3e-4ca3-452d-a49a-6efa4cafa06f sigma
496a0e47-0a33-4dca-b009-9e6ca3591f39 sigma
503fe26e-b5f2-4944-a126-eab405cc06e5 sigma
5588576c-5898-4fac-bcdd-7475a60e8f43 sigma
5a44727c-3b85-4713-8c44-4401d5499629 sigma
5a7132c0-86db-4e6b-95c0-f0e9d7f461aa sigma
6a53d871-682d-40b6-83e0-b7c1a6c4e3a5 sigma
6daac7fc-77d1-449a-a71a-e6b4d59a0e54 sigma
78cc2dd2-7d20-4d32-93ff-057084c38b93 sigma
7c3a5b1d-9e2f-4a8c-b5d7-1e0f3c6a9b2d sigma
7ec2c172-dceb-4c10-92c9-87c1881b7e18 sigma
916eb839-895e-47f8-99ee-3008bf377a3e sigma
94309181-d345-4cbf-b5fe-061769bdf9cb sigma
9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523 sigma
9e099d99-44c2-42b6-a6d8-54c3545cab29 sigma
a7664b14-75fb-4a50-a223-cb9bc0afbacf sigma
a861d835-af37-4930-bcd6-5b178bfb54df sigma
b1e0b3f5-b62e-41be-886a-daffde446ad4 sigma
b2e4a719-3c8f-4d1b-a507-f83c2d56e901 sigma
caa9a802-8bd8-4b9e-a5cd-4d6221670219 sigma
cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5 sigma
d04ae2b8-ad54-4de0-bd87-4bc1da66aa59 sigma
e3f7c841-2a9d-4b5e-c018-d94b3e67f012 sigma
e54979bd-c5f9-4d6c-967b-a04b19ac4c74 sigma
e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c sigma
e80a0fee-1a62-4419-b31e-0d0db6e6013a sigma
e96253b8-6b3b-4f90-9e59-3b24b99cf9b4 sigma
eca91c7c-9214-47b9-b4c5-cb1d7e4f2350 sigma

Tested by 16

14625569-6def-4497-99ac-8e7817105b55 atomic
29094950-2c96-4cbd-b5e4-f7c65079678f atomic
385e59aa-113e-4711-84d9-f637aef01f2c atomic
3f987809-3681-43c8-bcd8-b3ff3a28533a atomic
485ce873-2e65-4706-9c7e-ae3ab9e14213 atomic
615bd568-2859-41b5-9aed-61f6a88e48dd atomic
78d10e20-c874-45f2-a9df-6fea0120ec27 atomic
7f06b25c-799e-40f1-89db-999c9cc84317 atomic
81cfdd7f-1f41-4cc5-9845-bb5149438e37 atomic
8c385f88-4d47-4c9a-814d-93d9deec8c71 atomic
902f4ed2-1aba-4133-90f2-cff6d299d6da atomic
9726592a-dabc-4d4d-81cd-44070008b3af atomic
988539bc-2ed7-4e62-aec6-7c5cf6680863 atomic
d6139549-7b72-4e48-9ea1-324fc9bdf88a atomic
e42d33cd-205c-4acf-ab59-a9f38f6bad9c atomic
e6f4affd-d826-4871-9a62-6c9004b8fe06 atomic

Attack relationships

Framework references

Primary source: https://eladshamir.com/2019/01/28/Wagging-the-Dog.html
attack: T1558 (primary)
attack: T1187

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 361 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1558, attack:T1187 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 2 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 3 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)