PowerView RBCD abuse

Set-DomainObject -Identity <target-computer> -Set @{'msds-allowedtoactonbehalfofotheridentity'=$rawBytes}

Modifies the msds-allowedtoactonbehalfofotheridentity attribute on a computer object to enable Resource-Based Constrained Delegation (RBCD).

When you have write permissions on a computer object (e.g., via an ACL attack). RBCD allows a computer to delegate authentication to another, enabling user impersonation on the target service.

If the computer object is not modifiable (restricted permissions). Also if the domain has ADCS modification detections (Event ID 5136).