Here is a quick post on a Active Directory attack Vector called Kerberoasting which seems to have started gaining more and more prominence recently.
It is a technique used mostly to steal credentials and move laterally through the network.
What is Kerberoasting?
This is a technique that is carried out once a malicious actor gained access to a domain user account within a AD environment. User objects configured with a Service Principal Name (SPN), i.e. service accounts, can be exploited by malicious actors by requesting its Ticket Granting Service (TGS) ticket from a Domain Controller. This TGS ticket is encrypted with the hash of the service account's password.
Service accounts in particular can sometimes have additional privileges such as being a member of the Domain Admins Security Group.
Once the malicious actor has the TGS, it is then exfiltrated and with the enormous power of GPUs these days, will attempt to crack the password hash using brute force techniques. Once cracked, they can essentially use it to move through the network by authenticating as the account.
Actions such as attempts can be made to exfiltrate data, escalate or set back doors.
Mitigating Kerberoasting
- Minimise the number of user objects with SPNs
- Use Group Managed Service Accounts (gMSA) or Delegated Managed Service Accounts (dMSA) in Server 2025
- Service Accounts should use AES (128 and 256 bit) for Kerberos service ticket encryption
- If it is not possible to use gMSA accounts, set a unique, randomly generated password with at least 30 characters and rotate often
Detecting Kerberoasting
As this is legitimate Active Directory Activity, this type of activity can be quite hard to detect.
On Domain Controllers, check for Event ID's: 4738, 5136 & 4769
- 4738 & 5136 - These are generated when a user account is changed.
- 4769 - This is generated when a TGS ticket is requested. When executed maliciously this event is generated for each TGS ticket requested for a user object. Additionally, RC4 encryption is requested by the malicious actor as this is easier to crack.
