Constrained Delegation abuse
Named by 2 kept items in this workspace.
Search every workspace for Constrained Delegation abuse. It matches the name as written, so it can find other things that share it.
The items that name it 2
Mentioned as another DACL-based attack path with similar prerequisites, cited for comparison.
Using S4U2Self to request a forwardable TGS to oneself on behalf of any user, then S4U2Proxy to request a TGS to an allowed SPN, and exploiting the unprotected sname field to swap the service name and access an arbitrary service as that user
All techniques in this workspace.