Security research

posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1

https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1

Published on: posts.specterops.io

ATT&CK techniques those detections carry

T1021.002SMB/Windows Admin Shares
T1558.003Kerberoasting

4 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Register new Logon Process by Rubeus	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
DCERPC SMB Spoolss Named Pipe	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
SMB Spoolss Name Piped Usage	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 4 of 4

Filter in the catalogue