Credential delegation was denied by policy.
Blocked credential delegation may indicate attempt to use delegated credentials for lateral movement. Also indicates the policy is working correctly.
Alert: multiple blocked delegation attempts for the same account — possible lateral movement via delegation.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 5378 // The requested credentials delegation was disallowed by policy
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=5378
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The requested credentials delegation was disallowed by policy — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`The requested credentials delegation was disallowed by policy. Credential delegation was denied by policy.
Event 5378 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Credential Manager' subcategory (Success and/or Failure).
Alert: multiple blocked delegation attempts for the same account — possible lateral movement via delegation.