Kerberos delegation is a delegation setting that allows applications to request end-user access credentials to access resources on behalf of the originating user.

With Unconstrained Delegation, the server or the service account that is granted this right is able to impersonate a user to authenticate to any services on any host.

This video will demo how a threat actor can abuse this settings and cover some of the remediation actions that can be taken.

свернуть