Kerberos Delegation Abuse: Unconstrained, Constrained, and RBCD
The three flavours of Kerberos delegation, what each one hands an attacker, and why resource-based delegation is both the safest and the most abusable.
Red Team
Active Directory Certificate Services: ESC1 Through ESC8 in Practice
Why certificate services are the most reliable escalation path in enterprise AD, and the eight misconfigurations worth checking on every engagement.
Enumerating Azure AD with ROADtools and AzureHound
Mapping a Microsoft cloud tenant from a single set of valid credentials, and reading the result as an attack graph.
NTLM Relay Attacks: Coercion, Poisoning, and Defenses
Why relaying NTLM authentication is still effective in 2022, and what actually stops it.
BloodHound and SharpHound: Mapping Active Directory Attack Paths
How to collect the right AD data once, then query it as a graph instead of guessing your way to Domain Admin.