Kerberos Relay to LDAP for RBCD/Shadow Credentials

KrbRelayUp is a Windows local privilege-escalation chain that coerces the local machine account's Kerberos authentication and relays it to LDAP to establish an RBCD or Shadow Credentials control primitive, then uses a service ticket for an identity that is a local administrator on the target to create a SYSTEM service. The upstream project also documents an AD CS Web Enrollment relay path, which relays to the enrollment endpoint rather than LDAP; enforcing LDAP signing alone does not block that variant. LDAP-signing defaults depend on Windows Server generation and policy: new Windows Server 2025 AD deployments require signing by default, while older deployments did not enforce it by default, and upgrades preserve existing policy. The RBCD path's separate computer-account creation depends on quota or delegated rights; Shadow Credentials modifies the target computer account's msDS-KeyCredentialLink. These are alternative paths, not one mandatory sequence.