Recently, I had the opportunity to investigate a sophisticated attack involving Resource-Based Constrained Delegation (RBCD) in an Active Directory environment. This post walks you through the attack timeline, the techniques used by the threat actor, and how to respond, including detection automation and system hardening.
The Incident Timeline
It all began with a social engineering attack over Microsoft Teams. The attacker impersonated an internal staff member to trick a user into installing AnyDesk(portable), a remote access tool, gaining initial foothold in the network.Yes, admin creds are not needed for the portable version.
Shortly after, the user also shared an old password, possibly reused from a prior device, though it’s unclear if that password was still valid. Password reuse remains a common risk vector.
Sometime later, the attacker downloaded a ZIP file containing malicious scripts, including a VBScript used to escalate privileges silently by running msedge.exe in the background (Living-off-the-land)😉.
The RBCD Attack
On the same day, the attacker modified the Active Directory computer object attribute:
ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity
This attribute change indicated an RBCD attack, a powerful Kerberos delegation technique that enables attackers to impersonate users and move laterally within the domain without requiring traditional delegation flags or user credentials.
Technical Insights: How It Works
RBCD abuses Kerberos extension protocols:
- S4U2Self
- S4U2Proxy
These allow a service to request Kerberos tickets on behalf of a user without needing their password.
We suspect tools like Rubeus were used to automate ticket requests and impersonation.
The Curious Case of the Old Password
Although the old password originated from a retired device, the user might have reused it on active accounts or services. If the password was still valid, it could have helped the attacker authenticate to systems or escalate privileges.
Suggested Response: Detection & Hardening
To prevent future incidents and detect similar attacks early:
- Develop a Sentinel Playbook to monitor suspicious modifications of delegation attributes and unusual Kerberos ticket requests.
- Harden Active Directory by reviewing and tightening permissions on computer objects, especially removing unnecessary write access to delegation attributes.
- Educate users about the risks of password reuse and social engineering tactics.
- Implement stricter application control to block unauthorized remote access tools like AnyDesk.
Lessons Learned
- Social engineering remains the gateway for many complex attacks. Continuous user training is critical.
- Legacy AD objects and stale permissions can be weaponized even if the underlying devices are no longer active.
- Understanding advanced Kerberos delegation methods like RBCD is essential for modern Active Directory defense.
- Automating detection through playbooks significantly improves response times.
Sentinel Detection: RBCD & Kerberos Abuse
To detect RBCD attacks and related Kerberos abuse, I would create a Microsoft Sentinel playbook with the following logic:
Detection Queries (KQL)
1. LDAP Write to RBCD Attribute
SecurityEvent
| where EventID == 5136
| where tostring(parse_json(EventData).AttributeLDAPDisplayName) == "ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity"
| project TimeGenerated, Account, Computer, EventData
2. Suspicious Kerberos Ticket Requests (S4U2Self / S4U2Proxy)
SecurityEvent
| where EventID == 4769
| where TicketOptions has_any ("0x40000000", "0x80000000")
| project TimeGenerated, Account, ServiceName, TicketOptions
3. Silent msedge.exe Execution (Stealthy Execution and Living Off the Land)
Sysmon
| where EventID == 1 and ProcessName endswith "msedge.exe"
| where CommandLine contains "-silent" or CommandLine contains "--headless"
| project TimeGenerated, Account, Computer, CommandLine
Playbook Response Steps
- Trigger: Attribute change to
ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity - Correlate: Recent Kerberos activity and process execution
- Alert: SOC notification with impacted user or computer details
- (Optional) Auto-quarantine device or reset credentials
Outcome
- Reduce time to detect RBCD attempts
- Harden AD by auditing delegation permissions
- Playbook live and actively monitor in Sentinel
Tip: Stale AD objects and silent ticket abuse often go unnoticed. Monitor them proactively.
Final Thoughts
This incident highlighted how attackers combine human manipulation with technical exploits to bypass traditional defenses. It also reinforced the importance of defense-in-depth strategies, from user awareness to system hardening and active monitoring.
If you're managing Active Directory environments, take a close look at delegation settings and legacy objects. Tools and techniques like RBCD are becoming increasingly popular among attackers.
Thanks for reading! Cheers 🐀