Threat reportThreat IntelligenceTL-2026-4841
Cross-Domain & Cross-Forest Resource-Based Constrained Delegation (RBCD) Abuse in Active Directory
Cross-Domain & Cross-Forest Resource-Based Constrained (TL-2026-4841), also tracked as Cross-Domain RBCD, is a medium-severity tracked intrusion set, first published 2026-10-30. It has no confirmed attribution, affects Microsoft Active Directory Domain Services (multi-domain forests and, maps to 10 MITRE ATT&CK techniques (T1021.002, T1078.002, T1087.002), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4841
- Threat ID
- TL-2026-4841
- Also known as
- Cross-Domain RBCD, Cross-Forest RBCD, RBCD Abuse, Resource-Based Constrained Delegation Abuse
- Severity
- MEDIUM
- Status
- TRACKING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Cross-Domain & Cross-Forest Resource-Based Constrained
Malware and tooling: Rubeus, BloodHound - S0521, Impacket - S0357, Impacket getST.py (Synacktiv cross_forest_rbcd fork), Rubeus - S1071, ntlmrelayx.py
How Cross-Domain & Cross-Forest Resource-Based Constrained works
Synacktiv researchers (Simon Msika, Yann Razafimahefa) demonstrated that Resource-Based Constrained Delegation (RBCD) abuse via the msDS-AllowedToActOnBehalfOfOtherIdentity attribute can be extended beyond a single AD domain, chaining six or more S4U2Self/S4U2Proxy Kerberos exchanges across domain and forest boundaries. A modified Impacket getST.py (adding -targetdomain, -targetdc, -self, -u2u, -proxy, -proxydomain, -forest) and Rubeus's existing CrossDomainS4U implementation were used to build and reuse cross-realm referral tickets, enabling impersonation of a user across a child-to-parent trust and, with constraints, across certain forest trusts.
Resource-Based Constrained Delegation (RBCD) lets a resource owner (typically a computer object) specify, via the msDS-AllowedToActOnBehalfOfOtherIdentity attribute, which security principals may delegate authentication to it. Within a single domain this is a well-known privilege-escalation primitive: an attacker who can write that attribute on a target computer (e.g. because they control a machine account with a default MachineAccountQuota-created SPN, or because of an ACL misconfiguration) can request a Kerberos service ticket impersonating any user with Constrained Delegation's S4U2Self + S4U2Proxy extensions, then pass that ticket to the target (Rubeus /ptt or Impacket's getST.py).
Synacktiv's two-part research (March and July 2026) investigated whether this primitive still works when the delegating principal and the resource live in different domains of the same forest (cross-domain) or in different forests connected by a trust (cross-forest). In their lab (parent domain asgard.local, child domain dev.asgard.local, target workstation.asgard.local), the team mapped a six-step cross-domain exchange: (1) obtain a TGT for the attacker-controlled machine account rbcd_test$@dev.asgard.local from the child DC; (2) request a referral TGT from the child DC to reach the parent realm; (3) perform a cross-realm S4U2Self against the parent DC to obtain a referral service ticket for the impersonated user; (4) perform a second S4U2Self against the child DC using that referral to obtain a usable ticket for the impersonated user on the attacker's own service; (5) request a referral ticket via S4U2Proxy from the child DC; and (6) complete S4U2Proxy against the parent DC to obtain the final service ticket to the target (e.g. cifs/workstation.asgard.local). The team found that stock Impacket could not perform this chain because getST.py derives the realm for each TGS-REQ from the ticket supplied rather than letting the caller set it explicitly, and had to fork Impacket (-targetdomain, -targetdc) to force the correct realm in each request; a corresponding pull request (fortra/impacket#1202 by ShutdownRepo, adding -self, -altservice, -u2u) had already added related S4U2Self-only and U2U primitives to mainline Impacket, later merged via #1691.
Part two of the research (Yann Razafimahefa) extended the technique with a recursive S4U2Self[+U2U] and S4U2Proxy implementation that lets an attacker impersonate any user in the forest by walking the default transitive parent-child trust chain across an arbitrary number of domains, and introduced a 'branch-aware' S4U2Proxy algorithm (the variant Microsoft's own KDC implementation prefers) required for certain cross-forest paths; SPN-less RBCD (building on James Forshaw's 2022 research that the SPN requirement for U2U was not strictly enforced) was also shown to work across multiple domains.
Cross-forest RBCD is explicitly constrained by Microsoft's own KDC behavior: it only succeeds when the impersonated user belongs to the same forest as the principal permitted to delegate (users + proxy in one forest, resource in another), and fails with KDC_ERR_POLICY when the impersonated user, the resource, and the delegating principal span three different forests. The cross-forest chain (lab domain valhalla.local) also requires a second referral TGT and a 'branch-aware' S4U2Proxy flag at step four, and the final hop enforces RC4 encryption on the returned ticket regardless of the client's offered cipher list — RC4 phase-out on Windows Server 2022+ causes KDC_ERR_ETYPE_NOSUPP and blocks the SPN-less variant of the attack on fully patched/hardened DCs. Forged tickets produced by this chain carry Kerberos PAC artifacts including the Service Asserted Identity SID (S-1-18-2) and, in cross-forest tickets, a PAC_WAS_GIVEN_IMPLICITLY flag alongside standard forwardable/renewable/pre_authent/ok_as_delegate/enc_pa_rep ticket flags.
The practical precondition for any RBCD abuse chain, single-domain or cross-domain/forest, remains write access to msDS-AllowedToActOnBehalfOfOtherIdentity on a target object — commonly obtained via a default MachineAccountQuota-created computer account, NTLM relay (ntlmrelayx.py) of a coerced/poisoned authentication (e.g. via LLMNR/NBT-NS spoofing) to LDAP, or an existing ACL misconfiguration discovered by enumerating the domain/forest trust and ACL graph with BloodHound. Synacktiv's article lists Rubeus, the modified Impacket fork, ntlmrelayx.py, and BloodHound as the tools involved in reproducing and discovering these paths, and recommends LDAP signing/channel binding enforcement, disabling LLMNR/mDNS/unneeded IPv6, placing sensitive accounts in the Protected Users group or setting NOT_DELEGATED, minimizing unnecessary trust relationships, and routine ACL auditing with BloodHound as mitigations.
MITRE ATT&CK techniques used in TL-2026-4841
Lateral Movement
T1021.002 SMB/Windows Admin Shares; T1550.003 Pass the Ticket
Privilege Escalation
T1078.002 Domain Accounts; T1134.001 Token Impersonation/Theft
Discovery
T1087.002 Domain Account; T1482 Domain Trust Discovery
Persistence
Credential Access
T1557.001 Name Resolution Poisoning and SMB Relay; T1558 Steal or Forge Kerberos Tickets; T1558.005 Ccache Files
Affected products and versions in Cross-Domain & Cross-Forest Resource-Based Constrained
- Microsoft — Active Directory Domain Services (multi-domain forests and inter-forest trusts)
Vulnerable versions: Windows Server 2012 and later with Kerberos Constrained Delegation/RBCD support, multi-domain forests, and configured forest trusts
Fixed in: No vendor patch; mitigated via Protected Users/NOT_DELEGATED, LDAP signing/channel binding, reduced MachineAccountQuota, and RC4 phase-out on Windows Server 2022+ (blocks SPN-less variant only)
Remediation for Cross-Domain & Cross-Forest Resource-Based Constrained
Immediate actions
- Enforce LDAP signing and LDAP channel binding on all domain controllers to block NTLM-relay-to-LDAP attacks that set msDS-AllowedToActOnBehalfOfOtherIdentity
- Disable LLMNR, NBT-NS/mDNS, and unneeded IPv6 on endpoints to remove the name-resolution-poisoning relay primitive that commonly precedes RBCD attribute writes
- Audit msDS-AllowedToActOnBehalfOfOtherIdentity across all domains and forests with BloodHound to find existing delegation misconfigurations and unexpected cross-domain/cross-forest ACL paths
Workarounds
- Restrict write access to msDS-AllowedToActOnBehalfOfOtherIdentity to Domain Admins / Tier-0 accounts only via explicit ACL hardening
- Monitor and alert on changes to msDS-AllowedToActOnBehalfOfOtherIdentity on computer and service objects (directory service access auditing, Event ID 5136)
Longer-term hardening
- Place privileged and sensitive user accounts in the Protected Users security group or set the NOT_DELEGATED userAccountControl flag so accounts cannot be targeted by S4U2Self/S4U2Proxy impersonation
- Minimize and review the number of inter-domain and inter-forest trust relationships; avoid unnecessary forest trusts that extend the cross-realm RBCD attack surface
- Reduce default MachineAccountQuota to 0 to remove the common self-service path to an attacker-controlled computer account usable as a delegating principal
- Ensure domain controllers are at a patch/functional level that enforces RC4 phase-out (Windows Server 2022+) to break the SPN-less cross-domain/cross-forest RBCD variant
Timeline of Cross-Domain & Cross-Forest Resource-Based Constrained
- ShutdownRepo opens fortra/impacket PR #1202 adding -self, -altservice, and -u2u S4U2Self/U2U primitives to getST.py.
- PR #1202 updated with sAMAccountName-spoofing support for S4U-based attacks.
- James Forshaw publishes research showing the SPN requirement for Kerberos U2U/S4U2Self is not strictly enforced, later underpinning SPN-less RBCD across domains.
- U2U (user-to-user) capability added to the pending getST.py enhancement PR, enabling SPN-less RBCD experimentation.
- getST.py S4U2Self/U2U enhancements merged into mainline Impacket via consolidated PR #1691.
- Synacktiv (Simon Msika) publishes Part 1 of 'Exploring cross-domain & cross-forest RBCD', detailing the six-step cross-domain/cross-forest S4U2Self+S4U2Proxy chain and releasing a modified Impacket getST.py fork (-targetdomain, -targetdc, -forest).
- Part 2 documents Protected Users group membership, NOT_DELEGATED, and Windows Server 2022+ RC4 phase-out (causing KDC_ERR_ETYPE_NOSUPP) as effective controls against the SPN-less variant.
- Synacktiv (Yann Razafimahefa) publishes Part 2, extending the attack with a recursive S4U2Self[+U2U] implementation and a branch-aware S4U2Proxy algorithm for N-domain and additional cross-forest paths.
Sources cited for Cross-Domain & Cross-Forest Resource-Based Constrained
- Exploring cross-domain & cross-forest RBCD (Synacktiv, Simon Msika)
- Exploring cross-domain & cross-forest RBCD: Part 2 (Synacktiv, Yann Razafimahefa)
- getST.py: add -self, -altservice, -u2u for S4U2Self-only / U2U attacks (fortra/impacket PR #1202)
- Synacktiv modified Impacket fork (cross_forest_rbcd branch)
- Rubeus CrossDomainS4U implementation (GhostPack/Rubeus, S4U.cs)
- S4U2Pwnage (Will Schroeder / harmj0y)
- Crossing Trusts Part 4: Delegation
- Microsoft MS-SFU: Kerberos Protocol Extensions: Service for User and Constrained Delegation Protocol
- FreeIPA RBCD Use Cases design document
- RBCD-Attack: Kerberos Resource-Based Constrained Delegation Attack From Outside Using Impacket
- The Hacker Recipes — Impacket tool reference
Detection coverage for TL-2026-4841
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4841 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.