Lion Cipher Lab
Detect and defend against Kerberos RBCD (resource-based constrained delegation) abuse
- Identity & Access Management
- Advanced
- ~50 min
- Free · no account required
Why it matters
RBCD is one of the quietest privilege-escalation paths in Active Directory: with only a WRITE permission over a single computer object — a permission that looks harmless on an audit spreadsheet — an attacker can impersonate a Domain Admin to that host without ever knowing a password. It hides inside normal Kerberos, so it rarely trips the alarms teams already have. Learning to see where delegation trust lives, prove whether it's set, and shut the write path is core tier-0 defense — and it reframes a scary-sounding Kerberos exploit as what it actually is: an ACL problem.
What you'll learn
- Kerberos delegation models (unconstrained / constrained / resource-based)
- Parsing an msDS-AllowedToActOnBehalfOfOtherIdentity security descriptor
- Auditing directory writes with Event 5136 (and the SACL it requires)
- Reading Kerberos S4U telemetry (Event 4769 / Transited Services)
- Hardening AD against delegation abuse (MAQ 0, Protected Users, ACL least-privilege)
Steps in this lab
- The one-sentence version, and what you'll actually do
- Delegation, three ways — get the model straight first
- Why RBCD is dangerous — the chain, described, not weaponized
- Enumerate where RBCD is already configured (live command shown; offline parse next)
- Parse the trust attribute — synthetic descriptor, runs on any Windows PowerShell (offline)
- Detection #1 — Event 5136 on the write (and the SACL it demands)
- Detection #2 — Event 4769 and the S4U / Transited Services tell
- Defense — close the write path (this is the real fix)
- Named failure modes — where defenders get this wrong
- The judgment to walk away with