Unconstrained Delegation Explained

Semperis researchers, co-authoring with TrustedSec, detail the Diamond Ticket attack—a new Kerberos ticket-forging technique inspired by 2015 Diamond PAC research; covers Rubeus weaponization, OPSEC advantages, and detection guidance.

Why unconstrained delegation is among AD's worst security gaps: it lets a computer store users' Kerberos tickets and impersonate them, making it a prime target; removing the setting eliminates a weak link in trusted authentication chains.

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.

How attackers abuse Active Directory unconstrained delegation: coercing a DC to authenticate to a compromised host captures its TGT, enabling DCSync, Golden Tickets and full domain takeover.

Explains how Microsoft LAPS stores local admin passwords in LDAP, and how incorrect delegation on ms-MCS-AdmPwd can expose cleartext credentials that aid lateral movement.

Details five ways to find systems running Domain Admin processes: checking locally, querying domain controllers for sessions, scanning remote tasks, NetBIOS enumeration, and token spraying.