Command Manager

Cypher: Unconstrained Delegation

Find every computer or user with TRUSTED_FOR_DELEGATION set, excluding the DCs themselves. Coercing a privileged user (e.g. via PetitPotam) to authenticate to one of these hosts gives you their TGT.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
MATCH
Category
Enumeration / BloodHound Cypher Queries
Platform
cross-platform
Requires
no credentials

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

MATCH (c {unconstraineddelegation:true}) WHERE NOT c.name CONTAINS 'DC=' RETURN c.name, labels(c)

Examples

MATCH (c {unconstraineddelegation:true}) WHERE NOT c.name CONTAINS 'DC=' RETURN c.name

Tags

bloodhound cypher unconstrained-delegation tgt graph

References