SensePost | Constrained delegation considerations for lateral movement
Tags
attack-pattern: Credentials - T1589.001 Domain Account - T1087.002 Domain Account - T1136.002 Impersonation - T1656 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 New Service - T1050 Powershell - T1086
Show in Graph
Common Information
Type Value
UUID d21659b0-855e-4c02-be93-03b2ea0f1750
Fingerprint d5284d51200064e1
Analysis status DONE
Considered CTI value 0
Text language
Published May 18, 2022, midnight
Added to db Jan. 18, 2023, 10:27 p.m.
Last updated Nov. 13, 2024, 7:17 p.m.
Headline
Title SensePost | Constrained delegation considerations for lateral movement
Detected Hints/Tags/Attributes 57/1/16
Source URLs
Redirection Url
Details Source https://sensepost.com/blog/2022/constrained-delegation-considerations-for-lateral-movement/
URL Provider
Details Provider Source level domain
Details sensepost.com sensepost.com
Attributes
Details Type #Events CTI Value
Details Domain 6 
stealthbits.com
Details Domain 5 
shenaniganslabs.io
Details Domain 18 
www.tarlogic.com
Details Domain 37 
psexec.py
Details File 5 
wagging-the-dog.html
Details File 41 
www.tar
Details File 1 
delegation.pdf
Details File 34 
psexec.py
Details File 29 
rubeus.exe
Details md5 1 
5ffecaaedb763ea283d47ac8becf88f9
Details IPv4 1 
10.50.30.10
Details Url 1 
https://stealthbits.com/blog/what-is-kerberos-delegation-an-overview-of-kerberos-delegation
Details Url 4 
https://shenaniganslabs.io/2019/01/28/wagging-the-dog.html
Details Url 1 
https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
Details Url 1 
https://posts.specterops.io/kerberosity-killed-the-domain-an-offensive-kerberos-overview-eb04b1402c61
Details Url 1 
https://www.tarlogic.com/en/blog/kerberos-iii-how-does-delegation-work