title: Enabled User Right in AD to Control User Objects
id: 311b6ce2-7890-4383-a8c2-663a9f6b43cd
status: test
description: Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.
author: '@neu5ron'
references:
  - https://www.harmj0y.net/blog/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/
date: 2017/07/30
modified: 2021/12/02
logsource:
  product: windows
  service: security
  definition: 'Requirements: Audit Policy : Policy Change > Audit Authorization Policy Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authorization Policy Change'
detection:
  selection_base:
    EventID: 4704
  selection_keywords:
    PrivilegeList|contains:
      - 'SeEnableDelegationPrivilege'
  condition: all of selection*
falsepositives:
  - Unknown
level: high
tags:
  - attack.persistence
  - attack.t1098
