How do you detect unconstrained delegation abuse?

Detect unconstrained delegation abuse at three points. First, audit the flag: alert on Event 5136 or 4742 where the TrustedForDelegation bit (0x80000) is set on anything that is not a Domain Controller, and inventory existing hosts with LDAP. Second, watch for coercion: a DC machine account logging on to a delegation host, and MS-RPRN calls toward a DC. Third, detect replay with 4768 events for a DC machine account from a non-DC IP. Disable the Spooler on DCs and retire unconstrained hosts.

Detecting Unconstrained Delegation Abuse: TGT Capture and Coercion

When a computer account has the Trusted for delegation flag, it stores forwardable TGTs of connecting users in memory. An attacker who controls that host can coerce a Domain Controller to connect with the printer bug or a similar method, extract the DC’s TGT and replay it. Detection covers the flag, the coercion and the replay.

Signals at a Glance

Signal	Where	ATT&CK
TrustedForDelegation set on a non-DC computer or user	DC Security 5136, 4742	T1558
DC machine account network logon to a non-DC delegation host	Host Security 4624	T1187
RpcRemoteFindFirstPrinterChangeNotification from a host to a DC spooler	Network, Zeek dce_rpc	T1187
DC machine-account TGT requested from a non-DC IP	DC Security 4768	T1558
Hosts with unconstrained delegation that are not DCs	LDAP inventory	T1558

Find and Audit the Flag

The flag is bit 0x80000 (524288) in userAccountControl. Domain Controllers carry it by design; nothing else should. Auditing the attribute write catches new exposure as it is created, and an LDAP inventory finds the existing one:

SecurityEvent
| where EventID == 5136 and AttributeLDAPDisplayName == "userAccountControl"
| where OperationType == "%%14674"            // value added
| where binary_and(toint(AttributeValue), 524288) != 0
| where ObjectDN !has "OU=Domain Controllers"
| project TimeGenerated, SubjectUserName, ObjectDN, AttributeValue
// tune/validate: confirm AttributeValue is decimal in your logs.

# Existing exposure: unconstrained delegation outside the DCs (tune/validate)
Get-ADComputer -LDAPFilter "(&(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(primaryGroupID=516)))" `
  -Properties TrustedForDelegation, OperatingSystem |
  Select-Object Name, OperatingSystem, TrustedForDelegation

Coercion and Replay

The attack needs the DC to authenticate to the delegation host. On that host, a network logon by the DC machine account that has no business reason is the strongest host-side signal. On the DC side, the same machine account later requesting tickets from an unexpected IP shows the replay:

title: Domain Controller Machine Account TGT Requested From Non-DC
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4768
    TargetUserName|endswith: '$'
    Status: '0x0'
  filter_dc_ips:
    IpAddress|contains:
      - '10.0.1.10'   # tune/validate: all DC addresses, include IPv6 form ::ffff:
      - '10.0.1.11'
  condition: selection and not filter_dc_ips
level: high
# Scope TargetUserName to your DC account list to avoid every workstation firing.

Alert on 4624 type 3 Kerberos logons by a DC computer account on any host that holds the delegation flag.
Disable the Print Spooler on Domain Controllers; the printer bug needs it, and DCs have no use for it.
Mark privileged accounts as sensitive and unable to be delegated, and add them to the Protected Users group.
Prefer constrained or resource-based delegation to unconstrained, and retire unconstrained hosts.

Vetted sources

Use the SigmaHQ and Elastic delegation and coercion rules, Splunk ESCU delegation analytics, Microsoft’s Kerberos delegation documentation and Trimarc and SpecterOps guidance on delegation risk. Baseline your own environment — legacy application servers and some migration tools run with unconstrained delegation and should be the first items on your remediation list.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Find and Audit the Flag

Coercion and Replay

Build Detections That Fire

Active Directory Attack Detection

Detection Hub

NTLM Relay Detection

Silver Ticket Detection