# Cross-Domain & Cross-Forest Resource-Based Constrained Delegation (RBCD) Abuse in Active Directory

> Synacktiv researchers (Simon Msika, Yann Razafimahefa) demonstrated that Resource-Based Constrained Delegation (RBCD) abuse via the msDS-AllowedToActOnBehalfOfOtherIdentity attribute can be extended beyond a single AD domain, chaining six or more S4U2Self/S4U2Proxy Kerberos exchanges across domain and forest boundaries. A modified Impacket getST.py (adding -targetdomain, -targetdc, -self, -u2u, -proxy, -proxydomain, -forest) and Rubeus's existing CrossDomainS4U implementation were used to build and reuse cross-realm referral tickets, enabling impersonation of a user across a child-to-parent trust and, with constraints, across certain forest trusts.

- **Published:** 2026-10-30T17:04:49Z
- **Last reviewed:** 2026-10-30T17:04:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4841
- **ID:** TL-2026-4841
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Resource-Based Constrained Delegation (RBCD) lets a resource owner (typically a computer object) specify, via the msDS-AllowedToActOnBehalfOfOtherIdentity attribute, which security principals may delegate authentication to it. Within a single domain this is a well-known privilege-escalation primitive: an attacker who can write that attribute on a target computer (e.g. because they control a machine account with a default MachineAccountQuota-created SPN, or because of an ACL misconfiguration) can request a Kerberos service ticket impersonating any user with Constrained Delegation's S4U2Self + S4U2Proxy extensions, then pass that ticket to the target (Rubeus /ptt or Impacket's getST.py).

Synacktiv's two-part research (March and July 2026) investigated whether this primitive still works when the delegating principal and the resource live in different domains of the same forest (cross-domain) or in different forests connected by a trust (cross-forest). In their lab (parent domain asgard.local, child domain dev.asgard.local, target workstation.asgard.local), the team mapped a six-step cross-domain exchange: (1) obtain a TGT for the attacker-controlled machine account rbcd_test$@dev.asgard.local from the child DC; (2) request a referral TGT from the child DC to reach the parent realm; (3) perform a cross-realm S4U2Self against the parent DC to obtain a referral service ticket for the impersonated user; (4) perform a second S4U2Self against the child DC using that referral to obtain a usable ticket for the impersonated user on the attacker's own service; (5) request a referral ticket via S4U2Proxy from the child DC; and (6) complete S4U2Proxy against the parent DC to obtain the final service ticket to the target (e.g. cifs/workstation.asgard.local). The team found that stock Impacket could not perform this chain because getST.py derives the realm for each TGS-REQ from the ticket supplied rather than letting the caller set it explicitly, and had to fork Impacket (-targetdomain, -targetdc) to force the correct realm in each request; a corresponding pull request (fortra/impacket#1202 by ShutdownRepo, adding -self, -altservice, -u2u) had already added related S4U2Self-only and U2U primitives to mainline Impacket, later merged via #1691.

Part two of the research (Yann Razafimahefa) extended the technique with a recursive S4U2Self[+U2U] and S4U2Proxy implementation that lets an attacker impersonate any user in the forest by walking the default transitive parent-child trust chain across an arbitrary number of domains, and introduced a 'branch-aware' S4U2Proxy algorithm (the variant Microsoft's own KDC implementation prefers) required for certain cross-forest paths; SPN-less RBCD (building on James Forshaw's 2022 research that the SPN requirement for U2U was not strictly enforced) was also shown to work across multiple domains.

Cross-forest RBCD is explicitly constrained by Microsoft's own KDC behavior: it only succeeds when the impersonated user belongs to the same forest as the principal permitted to delegate (users + proxy in one forest, resource in another), and fails with KDC_ERR_POLICY when the impersonated user, the resource, and the delegating principal span three different forests. The cross-forest chain (lab domain valhalla.local) also requires a second referral TGT and a 'branch-aware' S4U2Proxy flag at step four, and the final hop enforces RC4 encryption on the returned ticket regardless of the client's offered cipher list — RC4 phase-out on Windows Server 2022+ causes KDC_ERR_ETYPE_NOSUPP and blocks the SPN-less variant of the attack on fully patched/hardened DCs. Forged tickets produced by this chain carry Kerberos PAC artifacts including the Service Asserted Identity SID (S-1-18-2) and, in cross-forest tickets, a PAC_WAS_GIVEN_IMPLICITLY flag alongside standard forwardable/renewable/pre_authent/ok_as_delegate/enc_pa_rep ticket flags.

The practical precondition for any RBCD abuse chain, single-domain or cross-domain/forest, remains write access to msDS-AllowedToActOnBehalfOfOtherIdentity on a target object — commonly obtained via a default MachineAccountQuota-created computer account, NTLM relay (ntlmrelayx.py) of a coerced/poisoned authentication (e.g. via LLMNR/NBT-NS spoofing) to LDAP, or an existing ACL misconfiguration discovered by enumerating the domain/forest trust and ACL graph with BloodHound. Synacktiv's article lists Rubeus, the modified Impacket fork, ntlmrelayx.py, and BloodHound as the tools involved in reproducing and discovering these paths, and recommends LDAP signing/channel binding enforcement, disabling LLMNR/mDNS/unneeded IPv6, placing sensitive accounts in the Protected Users group or setting NOT_DELEGATED, minimizing unnecessary trust relationships, and routine ACL auditing with BloodHound as mitigations.

## MITRE ATT&CK

- T1558 Steal or Forge Kerberos Tickets
- T1558.005 Ccache Files
- T1550.003 Pass the Ticket
- T1134.001 Token Impersonation/Theft
- T1098 Account Manipulation
- T1482 Domain Trust Discovery
- T1087.002 Domain Account
- T1078.002 Domain Accounts
- T1021.002 SMB/Windows Admin Shares
- T1557.001 Name Resolution Poisoning and SMB Relay

## Sources

- [Exploring cross-domain & cross-forest RBCD (Synacktiv, Simon Msika)](https://www.synacktiv.com/en/publications/exploring-cross-domain-cross-forest-rbcd.html)
- [Exploring cross-domain & cross-forest RBCD: Part 2 (Synacktiv, Yann Razafimahefa)](https://www.synacktiv.com/en/publications/exploring-cross-domain-cross-forest-rbcd-part-2)
- [getST.py: add -self, -altservice, -u2u for S4U2Self-only / U2U attacks (fortra/impacket PR #1202)](https://github.com/fortra/impacket/pull/1202)
- [Synacktiv modified Impacket fork (cross_forest_rbcd branch)](https://github.com/synacktiv/impacket/tree/cross_forest_rbcd)
- [Rubeus CrossDomainS4U implementation (GhostPack/Rubeus, S4U.cs)](https://github.com/GhostPack/Rubeus/blob/master/Rubeus/lib/S4U.cs#L626)
- [S4U2Pwnage (Will Schroeder / harmj0y)](https://harmj0y.medium.com/s4u2pwnage-36efe1a2777c)
- [Crossing Trusts Part 4: Delegation](https://exploit.ph/crossing-trusts-4-delegation.html)
- [Microsoft MS-SFU: Kerberos Protocol Extensions: Service for User and Constrained Delegation Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/)
- [FreeIPA RBCD Use Cases design document](https://freeipa.readthedocs.io/en/latest/designs/rbcd.html#use-cases)
- [RBCD-Attack: Kerberos Resource-Based Constrained Delegation Attack From Outside Using Impacket](https://hakin9.org/rbcd-attack-kerberos-resource-based-constrained-delegation-attack-from-outside-using-impacket/)
- [The Hacker Recipes — Impacket tool reference](https://tools.thehacker.recipes/impacket)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4841