Potential Unconstrained Delegation Discovery Via Get-ADComputer

SigmaHQ Detections@sigmaHQ

•updated Apr 7, 2025•0•14

Detects the use of the 'Get-ADComputer' cmdlet with specific parameters or LDAP filters to identify systems configured for unconstrained delegation. This activity is often performed by adversaries during the reconnaissance phase to find targets for Kerberos-based attacks like credential theft.