Hackers Abuse Active Directory SPN Misconfigurations for Stealthy Kerberoasting Attacks

Severity

Medium

Detail

Security researchers have identified a technique known as “Ghost SPN”, which abuses Active Directory Service Principal Name (SPN) misconfigurations to conduct stealthy Kerberoasting attacks. The technique allows threat actors with delegated directory permissions to temporarily assign an SPN to a standard user account, request a Kerberos service ticket, and remove the SPN shortly afterward to reduce forensic evidence.

Kerberoasting is a credential access technique that enables attackers to obtain Kerberos service tickets associated with SPN-enabled accounts and attempt offline password cracking. Successful password recovery may provide attackers with valid credentials that can be used for privilege escalation, lateral movement, and further compromise of the Active Directory environment.

Researchers observed that the attack does not require privileged service accounts. Instead, ordinary user accounts can be temporarily transformed into Kerberoasting targets, creating a potential blind spot for defenders who focus primarily on traditional service accounts.

How?

The attack begins when a threat actor abuse delegated Active Directory permissions that allow modification of account objects. A legitimate-looking SPN is temporarily assigned to a standard user account outside approved administrative processes, making the account eligible for Kerberos service ticket requests.

Once the SPN has been added, the attacker requests a Ticket Granting Service (TGS) ticket for the modified account and obtains ticket material that may be encrypted using RC4-HMAC. Because RC4-derived keys are generally more susceptible to offline password cracking than modern encryption algorithms, attackers can attempt password recovery without generating authentication failures or account lockouts.

After obtaining the service ticket, the attacker may remove the SPN from the account to eliminate evidence of the configuration change. The extracted ticket can subsequently be used for offline cracking or pass-the-ticket activities, allowing access to services without repeatedly authenticating with account credentials.

The attack may be combined with credential theft tools, PowerShell abuse, and obfuscated scripts to further reduce detection opportunities. Since TGS requests can resemble legitimate Kerberos activity, the attack can remain unnoticed unless organizations actively monitor for abnormal SPN modifications and unusual Kerberos authentication patterns.

Recommendation

Organizations should implement the following measures to reduce the risk of Ghost SPN and Kerberoasting attacks:

• Review and restrict delegated Active Directory permissions, particularly permissions that allow users to modify account attributes, including SPNs.
• Monitor for unexpected SPN additions and removals, especially on standard user accounts that are not designated as service accounts.
• Investigate unusual Kerberos Event ID 4769 activity, including excessive service ticket requests and RC4-encrypted TGS tickets (Encryption Type 0x17).
• Migrate eligible services to Managed Service Accounts (MSAs) or Group Managed Service Accounts (gMSAs) to reduce reliance on manually managed passwords.
• Configure service accounts to use AES-based Kerberos encryption and disable RC4 where compatibility requirements permit.
• Enforce strong, unique passwords for service accounts and rotate credentials regularly.

Conclusion

The Ghost SPN technique demonstrates how threat actors can abuse delegated Active Directory permissions to create temporary Kerberoasting opportunities while leaving minimal evidence behind. By assigning and subsequently removing SPNs from standard user accounts, attackers can obtain Kerberos service tickets suitable for offline password cracking without relying on traditional service accounts. The use of temporary SPN assignments and legitimate Kerberos functionality makes the activity more difficult to detect and increases the risk of credential compromise, privilege escalation, and lateral movement within Active Directory environments.

Source

https://cybersecuritynews.com/active-directory-spn-misconfigurations/