Active › Module 6 › Lesson 3
Delegation Named
Kerberos delegation types named — unconstrained, constrained, RBCD — literacy and hardening on $LAB_AD, not stranger-domain abuse recipes.
Visual · t25_delegation_named
Delegation = named Kerberos trust misuse classes. Harden first. $LAB_AD only. Original Cyberlium.
Opening
Delegation lets services act as users — misconfiguration is a defender ticket, not a free pass to impersonate strangers.
Kerberos delegation literacy names: unconstrained delegation (T1558.001 context — service can cache TGTs), constrained delegation (S4U2self/S4U2proxy to specified SPNs), resource-based constrained delegation RBCD (msDS-AllowedToActOnBehalfOfOtherIdentity). Analyst maps each to risk: unconstrained on member server = high, RBCD mis-ACL = lateral path category. Defenders: avoid unconstrained, audit TRUSTED_FOR_DELEGATION, monitor 4769 anomalies, limit who can edit RBCD attributes. Cyberlium names types on YOUR $LAB_AD — NOT RBCD takeover cookbooks on stranger domains, NOT configuring delegation on systems you do not admin, NOT S4U abuse walkthroughs against production. Lab row: one delegation type found in lab with hardening recommendation.
1. Three delegation classes
Unconstrained: service stores user TGTs — legacy high risk.
Constrained: allowed SPN list. RBCD: resource decides who can delegate — ACL-sensitive.
Command guide
Try these commands — Three delegation classes
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE T1558.001 Unconstrained Delegation — https://attack.mitre.org/techniques/T1558/001/ MITRE T1558.002 Constrained Delegation — https://attack.mitre.org/techniques/T1558/002/ Microsoft delegation — https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview (delegation hygiene)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 - <<'PY'
deleg = ['Unconstrained', 'Constrained', 'Resource-Based Constrained (RBCD)']
for d in deleg: print(f'delegation literacy: {d} — audit in YOUR lab AD only')
print('Defender: avoid unconstrained on non-DCs; monitor 4769 for RBCD abuse')
PYCommand — copy this
curl -sS https://attack.mitre.org/techniques/T1558/001/ | head -6 curl -sS https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview | head -6
Primary tools to practice this lesson: curl, python3. Reference sites: MITRE T1558.001 Unconstrained Delegation (https://attack.mitre.org/techniques/T1558/001/); MITRE T1558.002 Constrained Delegation (https://attack.mitre.org/techniques/T1558/002/); Microsoft delegation (https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender hardening
Eliminate unconstrained where possible, audit delegation flags, restrict RBCD edit rights.
Monitor Kerberos 4769 for unusual delegation patterns on Tier 0 assets.
3. Refused use
No delegation abuse recipes on unauthorized AD, no 'RBCD to DA' homework on employer forest.
Literacy output: type name + risk + fix — not impersonation proof on stranger DC.
4. What you ship: delegation literacy card
Three types defined + one lab misconfig row + hardening trio + scope line.
5. What you record before the next lesson
Delegation literacy card path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Configure RBCD on production app server without change board to 'learn delegation.'
Right
Delegation types named with hardening. Next: Paths Lab.
Mission: delegation literacy card
1) Define unconstrained constrained RBCD one line each. 2) One $LAB_AD misconfig row. 3) List three hardening actions. 4) Write NEVER stranger-domain delegation abuse.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “RBCD — which ACL edits to audit?”
Knowledge Check
APPLY: Unconstrained delegation risk:
Multiple choice
Knowledge Check
APPLY: True or False: RBCD takeover cookbook on stranger AD is lab.
True or False
Knowledge Check
APPLY: Defenders reduce delegation abuse by:
Multiple choice