Windows Delegation Edge Cases: Constrained, Unconstrained, and RBCD
Lab klist/setspn dumps redacted, unconstrained vs constrained vs RBCD text diagrams — flags and ACLs, not an abuse chain.
Operating Systems
Active Directory Recon Notes: What Enumerations Reveal
Fake lab DC ldapsearch and PowerView-style listings, 4662/1644/4624 event IDs — inventory, not an attack playbook.
Kerberos Constrained Delegation Map for Analysts
Lab klist and setspn dumps redacted, constrained-delegation allow-list map — no ticket forging, no S4U abuse.
Linux LKM and Syscall Hooking Concepts for Defenders
Lab LKM that logs openat on a VM, insmod/rmmod, dmesg artifacts — module does not hide files or hook the table for concealment.