SPN-jacking: An Edge Case in WriteSPN Abuse

Charlie Clark shows attackers can request Kerberos service tickets from the authentication service for unarmored machine accounts—new paths and detection bypasses Microsoft calls by design.

Practical exploitation of Bronze Bit (CVE-2020-17049): attackers with a service account hash can bypass Protected Users and TrustedToAuthForDelegation restrictions to abuse Kerberos delegation paths.

Overview of the Bronze Bit attack (CVE-2020-17049), which abuses Kerberos constrained delegation by flipping the forwardable flag on service tickets to impersonate users marked as sensitive.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Eleven risks that survive AD migrations — inherited admin rights, recreated attack paths, SID-history abuse and more — and how a security-first approach keeps legacy exposure out of the new forest.

Unconstrained delegation lets a service impersonate users across the domain; attackers hunt such servers, capture Kerberos TGTs with Rubeus, and move laterally. Mechanics and remediation covered.