Cybercriminals are increasingly taking advantage of overlooked misconfigurations in Active Directory service principal names (SPNs) to execute more covert Kerberoasting attacks. This shift allows attackers to target regular user accounts as high-value credential sources.
Innovative Attack Technique
Researchers at Trellix have identified a method they call “Ghost SPN,” which enables attackers with certain directory privileges to temporarily assign an SPN to a standard account. This maneuver allows them to request a Kerberos service ticket and subsequently erase traces of the change, evading detection by security teams.
Kerberoasting, a credential access strategy recognized as MITRE ATT&CK T1558.003, involves attackers with a valid Kerberos ticket-granting ticket requesting ticket-granting service (TGS) tickets for accounts linked to SPNs. These tickets can be utilized to attempt offline password cracking without the need for repeated domain authentication.
Understanding SPN Vulnerabilities
Typically, SPNs are used to identify services such as Microsoft SQL Server or LDAP instances that depend on Kerberos authentication. Security audits often prioritize these service accounts, assuming they are tied to dedicated service identities. However, the Ghost SPN technique exploits this assumption by attaching an SPN to a regular user account through delegated permissions, bypassing established administrative protocols.
Once the SPN is assigned, the account can request Kerberos service tickets and attackers can enumerate SPNs across the domain to identify potential targets. These tickets may be encrypted using RC4-HMAC, a weaker encryption standard, making them more appealing for attackers due to the ease of offline cracking.
Mitigation Strategies
Detecting these attacks can be challenging as they generate minimal noise and can be brief in execution. Trellix suggests focusing on auditing Active Directory permissions and monitoring anomalous Kerberos service-ticket requests, particularly those employing RC4 encryption.
Organizations are advised to reduce the number of accounts capable of producing vulnerable service tickets by transitioning to managed service accounts with centrally managed credentials. When possible, AES encryption should be enforced to secure Kerberos tickets, and RC4 should be disabled to minimize susceptibility to these attacks.
Furthermore, reviewing permissions that allow users to modify account objects and setting alerts for unexpected SPN changes can help in early detection and prevention of such incidents.
In conclusion, while these SPN misconfigurations present significant risks, a proactive approach involving the use of updated security practices and vigilant monitoring can mitigate potential threats posed by these advanced attack techniques.
