srl
Kerberos Delegation
Delegation lets a service act on behalf of a user to reach another service. Misconfigured delegation remains one of the most direct paths to Domain Admin: if you control a service trusted for delegation, you can impersonate any user — including administrators — to the delegated resource. The three classic models still define the attack surface, but 2025–2026 added new primitives around coercion-to-relay-to-RBCD, cross-forest RBCD, and SPN-collision attacks (KerberLoss) that change how you approach a modern environment.