Hackers Abuse Active Directory SPN Misconfigurations for Stealthy Kerberoasting Attacks

Threat actors are increasingly abusing overlooked Active Directory service principal name (SPN) misconfigurations to launch stealthier Kerberoasting attacks, turning ordinary user accounts into high-value credential targets.

The technique, dubbed “Ghost SPN” by Trellix researchers, can allow an intruder with delegated directory permissions to temporarily assign an SPN to a standard account, request a Kerberos service ticket, and remove evidence of the configuration change before defenders notice.

Kerberoasting is a credential-access technique tracked as MITRE ATT&CK T1558.003. An adversary with a valid Kerberos ticket-granting ticket can request ticket-granting service (TGS) tickets for accounts associated with SPNs.

Parts of those tickets may be protected using keys derived from the target account’s password hash, enabling attackers to take the ticket data offline and attempt password cracking without repeatedly authenticating to the domain.

A Blind Spot in Active Directory

SPNs normally identify services such as Microsoft SQL Server, HTTP applications, or LDAP instances that rely on Kerberos authentication. Security teams commonly expect these values to be tied to dedicated service identities and may focus their audits on privileged service accounts.

The Ghost SPN scenario exploits that assumption: an attacker abuses a delegated permission, such as the ability to modify an account object, to attach a plausible-looking SPN to an ordinary user account outside approved administration workflows.

Once the directory accepts the new SPN, the account becomes eligible to request Kerberos service tickets. An attacker can then enumerate SPNs across the domain, identify the newly exposed account, and request a TGS ticket.

The central danger is not merely that an SPN exists, but that the service ticket may be encrypted using RC4-HMAC, also identified as encryption type 0x17. RC4-based Kerberos tickets are particularly attractive to attackers because their password-derived keys can be tested more efficiently offline than stronger modern encryption options.

Unlike online password guessing, offline cracking does not trigger a stream of failed login events or account lockouts. That gives attackers time to test stolen ticket material away from the victim environment. If the target account has a weak, reused, or predictable password, cracking can reveal usable credentials and enable further privilege escalation or lateral movement.

The attack chain can be difficult to spot because its most consequential stages can be brief and low-noise. Trellix says the technique uses delegated administrative permissions to create temporary exposure windows through out-of-band SPN assignment, meaning the attribute is changed outside normal service deployment or change-management processes.

After obtaining the ticket, attackers may attempt to remove the malicious SPN, leaving defenders with fewer persistent directory indicators. The stolen ticket can also be exported from memory and used in pass-the-ticket activity, where an attacker presents Kerberos ticket material to access a service without supplying the account password again.

In a real intrusion, this can be paired with PowerShell abuse, obfuscated scripts, and credential-theft tooling to make endpoint-only detection less reliable.

Defenders should not assume that only traditional service accounts are exposed to Kerberoasting. Microsoft specifically recommends auditing user accounts with SPNs and removing SPNs that are no longer required, reducing the number of objects that can be targeted.

Network and identity telemetry are critical because the malicious TGS request can resemble normal Kerberos activity in isolation. MITRE recommends monitoring anomalous Kerberos service-ticket requests, especially Event ID 4769 events involving RC4 encryption, bursts of TGS requests from a single account, or service-ticket requests that do not fit established usage patterns.

Correlating these anomalies with suspicious process behavior, including attempts to access LSASS or use credential-dumping tools, can improve detection confidence.

The most effective defense is to reduce the number and value of accounts that can produce crackable service tickets. Organizations should migrate eligible services to group Managed Service Accounts or delegated Managed Service Accounts, which support centrally managed credentials and reduce the risk posed by manually maintained service-account passwords. Microsoft recommends using long, randomly generated passwords when managed service accounts are not feasible.

Administrators should also ensure service accounts use AES encryption for Kerberos tickets, reset passwords after updating encryption settings so AES keys are generated, and plan to disable RC4 where compatibility permits.

Microsoft has warned that RC4 remains enabled by default in many environments despite being more susceptible to Kerberoasting and has advised customers to manually disable it for service accounts where possible.

Finally, security teams should review delegated Active Directory permissions, particularly rights that let users modify other account objects—and alert on unexpected SPN additions, removals, and RC4-encrypted TGS requests.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Abuse Active Directory SPN Misconfigurations for Stealthy Kerberoasting Attacks appeared first on Cyber Security News.