Constrained Delegation Considerations for Lateral Movement

This post explains how attackers can abuse Active Directory constrained delegation to impersonate users and move laterally by altering Kerberos service tickets, even when the configured delegated service (e.g., eventlog) is not directly useful. It covers enumeration of delegation settings, the S4U process, and practical execution from Linux and Windows using Cerbero, Impacket, and Rubeus to obtain and inject CIFS/HTTP/HOST/RPCSS tickets for PsExec, WinRM, and WMI, along with operational considerations to evade detection.