AD-UNC-DELLateral Movement

Unconstrained Delegation Abuse

Coerce a high-value account to authenticate to a server with unconstrained delegation and steal its TGT.

§ Where this technique fits

AD-UNC-DEL is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

Unconstrained delegation → Capture DC TGT → DCSync
Compromise a host with TRUSTED_FOR_DELEGATION, coerce a DC to authenticate to it, harvest the DC's TGT from its LSASS, then DCSync.
step 3 / 7

§ What commonly comes next

01
Authentication Coercion
AD-COERCE · Initial Access
seen 1×
02
Pass the Ticket
T1550.003 · Lateral Movement
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Unconstrained delegation → Capture DC TGT → DCSync

§ What commonly comes next