LAPS Password Read Followed by RBCD Attribute Modification on Same Account

ills3c Intel&Coffee@Ills3C

•updated yesterday•4•0•6

Detects when an account reads a Local Administrator Password Solution (LAPS) password attribute and subsequently modifies the resource-based constrained delegation (msDS-AllowedToActOnBehalfOfOtherIdentity) attribute within a 4-hour window, which may indicate privilege escalation activity.