Kerberos delegation abuse

When it applies

An AD engagement where enumeration (BloodHound, nxc, LDAP) shows a delegation primitive: a host trusted for unconstrained delegation, an account with constrained delegation (msDS-AllowedToDelegateTo), or — most commonly — write access over a computer object so you can set RBCD. Coercion + relay turns "can authenticate a DC" into "control a DC". This is the modern lateral-movement/DA path.

Why it works

Delegation lets a service act on behalf of a user. Kerberos implements it with S4U2Self (get a ticket to yourself as any user) and S4U2Proxy (forward it to a target service). If you control an account permitted to delegate — or can write msDS-AllowedToActOnBehalfOfOtherIdentity on a target (RBCD) — you can mint a service ticket as any user, including Domain Admin, to that target.