AD Misconfigurations Enable Stealthy Kerberoasting Attacks

Key Takeaways

• Cybersecurity researchers have uncovered a novel Kerberoasting attack technique dubbed “Ghost SPN,” which leverages Active Directory misconfigurations.
• The method allows attackers to temporarily assign a Service Principal Name (SPN) to ordinary user accounts, request a Kerberos service ticket, and then remove the SPN to evade detection.
• This technique exploits a blind spot in Active Directory auditing, turning low-privilege accounts into targets for offline password cracking, particularly when RC4 encryption is used.
• Defenders are urged to audit SPNs on user accounts, migrate to Managed Service Accounts, disable RC4 encryption where possible, and enhance monitoring for anomalous Kerberos activity.

Threat actors are increasingly exploiting overlooked misconfigurations within Active Directory’s Service Principal Names (SPNs) to execute highly stealthy Kerberoasting attacks. This tactic transforms standard user accounts into prime targets for credential theft, often without triggering immediate alerts.

Researchers at Trellix have named this sophisticated technique “Ghost SPN.” It enables an attacker with delegated directory permissions to temporarily assign an SPN to a typical user account. Following this, the attacker requests a Kerberos service ticket and, crucially, removes any trace of the SPN modification before security teams can detect the change.

Kerberoasting, categorized by MITRE ATT&CK as T1558.003, is a credential-access method where an attacker possessing a valid Kerberos ticket-granting ticket (TGT) can request ticket-granting service (TGS) tickets for accounts associated with SPNs.

A critical vulnerability arises because portions of these TGS tickets are often protected using keys derived from the target account’s password hash. This allows adversaries to extract the ticket data for offline password cracking, bypassing the need for repeated authentication attempts against the domain and avoiding lockout policies.

A Blind Spot in Active Directory

SPNs typically identify network services like Microsoft SQL Server, HTTP applications, or LDAP instances that rely on Kerberos for authentication. Security professionals commonly expect these SPNs to be linked to dedicated service identities and, consequently, often concentrate their audit efforts on privileged service accounts.

The Ghost SPN scenario directly exploits this common assumption. An attacker abuses a delegated permission, such as the right to modify an account object, to attach a seemingly legitimate SPN to an ordinary user account. This occurs outside of standard administrative workflows and approved change management processes.

Once Active Directory accepts the newly assigned SPN, the user account becomes eligible to issue Kerberos service tickets. The attacker can then enumerate SPNs across the domain, identify the newly exposed account, and request a TGS ticket for it.

A significant concern is not merely the presence of an SPN, but the potential for the service ticket to be encrypted with RC4-HMAC, identified as encryption type 0x17. RC4-based Kerberos tickets are particularly appealing to attackers because their password-derived keys can be cracked offline far more efficiently than those protected by stronger, modern encryption algorithms.

Unlike online password guessing, which typically generates a flurry of failed login events or account lockouts, offline cracking leaves no such forensic trail. This allows attackers ample time to test stolen ticket material in an isolated environment. Should the target account use a weak, reused, or predictable password, successful cracking can yield usable credentials, paving the way for further privilege escalation or lateral movement within the network.

The entire attack chain is notoriously difficult to detect because its most critical stages are brief and generate minimal noise. Trellix says the technique leverages delegated administrative permissions to create temporary windows of exposure through out-of-band SPN assignment. This means the attribute is altered outside of standard service deployment or change-management procedures.

After successfully obtaining the ticket, attackers may attempt to remove the malicious SPN, leaving defenders with fewer persistent indicators within the directory. The stolen ticket can also be exported from memory and used in “pass-the-ticket” attacks, where an attacker presents Kerberos ticket material to access a service without ever needing to supply the account password again.

In a real-world intrusion, this technique can be combined with PowerShell abuse, obfuscated scripts, and credential-theft tools, making endpoint-only detection less reliable.

Defenders should no longer assume that only traditional service accounts are vulnerable to Kerberoasting. Microsoft explicitly advises auditing user accounts for SPNs and removing any that are no longer necessary, thereby reducing the attack surface.

Robust network and identity telemetry are crucial, as a malicious TGS request, when viewed in isolation, can appear indistinguishable from legitimate Kerberos activity. MITRE recommends monitoring for anomalous Kerberos service-ticket requests, specifically focusing on Event ID 4769 events that involve RC4 encryption, sudden bursts of TGS requests from a single account, or service-ticket requests that deviate from established usage patterns.

Correlating these anomalies with suspicious process behavior, such as attempts to access LSASS or the use of credential-dumping utilities, can significantly boost detection confidence.

What You Should Do

• Reduce Crackable Tickets: Minimize the number and value of accounts capable of generating easily crackable service tickets.
• Migrate to Managed Service Accounts (MSAs): Transition eligible services to group Managed Service Accounts (gMSAs) or delegated Managed Service Accounts (dMSAs), which offer centrally managed credentials and mitigate risks associated with manually maintained service-account passwords.
• Use Strong Passwords: For service accounts where MSAs are not feasible, implement long, randomly generated passwords.
• Prioritize AES Encryption: Ensure all service accounts are configured to use AES encryption for Kerberos tickets. After updating encryption settings, reset passwords to generate new AES keys.
• Disable RC4: Plan to disable RC4 encryption for Kerberos where compatibility permits. Microsoft has warned that RC4, despite its susceptibility to Kerberoasting, remains enabled by default in many environments. Manually disable it for service accounts whenever possible.
• Review Delegated Permissions: Conduct a thorough review of delegated Active Directory permissions, paying particular attention to rights that allow users to modify other account objects.
• Monitor for Anomalies: Implement alerts for unexpected SPN additions, removals, and RC4-encrypted TGS requests. Monitor Kerberos Event ID 4769 for unusual patterns.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.