ADKERB-001: Cuentas vulnerables a Kerberoasting
- Plataforma
- Active Directory
- Categoría
- AD Kerberos Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las cuentas de usuario con Service Principal Names (SPN) son vulnerables a Kerberoasting, donde cualquier usuario autenticado del dominio puede solicitar un ticket de servicio cifrado con el hash de la contraseña de la cuenta e intentar descifrarlo sin conexión. Este ataque no requiere privilegios especiales y es difícil de detectar. Cada cuenta de usuario con SPN representa un vector potencial de exposición de credenciales.
Por qué importa
Kerberoasting is the most reliable path from any domain user to Tier 0 in real environments. Microsoft Defender for Identity, Mandiant, and Secureworks all consistently rank it in the top three lateral-movement techniques observed in ransomware and APT engagements. The attack has four properties that make it durable. (1) It is entirely passive from the targets perspective: the request is a standard TGS-REQ that the KDC happily services for any authenticated user, generating Event ID 4769 that looks identical to legitimate service ticket requests. (2) It bypasses account lockout because cracking is performed offline against the harvested ticket. (3) It bypasses MFA because the service ticket is issued based on the TGT, not a fresh interactive logon. (4) The blast radius is determined entirely by the privilege of the SPN-bearing account, which historically has been high because SQL Server, IIS, SCCM, vCenter, MSSQLSvc, and home-grown applications were commonly installed under domain user accounts that were then granted Domain Admin "just to make it work." A single weak password on a single Kerberoastable account that holds Tier 0 group membership compromises the entire forest. The technique is in active use by Conti, LockBit, BlackCat, APT29, Volt Typhoon, and essentially every modern intrusion playbook.
Ruta de ataque
Step 1: Foothold. The attacker holds credentials for any enabled domain user account, obtained via phishing, password spray, NTLM relay, or a low-privilege initial access vector. No groups, no SeDebugPrivilege, no local admin anywhere is required. Step 2: SPN enumeration. The attacker queries LDAP for users with SPNs: Get-DomainUser -SPN (PowerView), GetUserSPNs.py -dc-ip 10.0.0.1 contoso.local/lowpriv:Password123 (Impacket), or Rubeus.exe kerberoast /stats. Modern tradecraft filters out high-RC4-cost accounts and prioritizes accounts in privileged groups via BloodHound edge MemberOf to Domain Admins. Step 3: Ticket request. The attacker triggers a TGS-REQ for each SPN: Rubeus.exe kerberoast /outfile:hashes.txt /nowrap, or GetUserSPNs.py -request. Rubeus and Impacket explicitly request etype RC4_HMAC (0x17) in the KRB-REQ body, which most KDCs honor for backwards compatibility unless msDS-SupportedEncryptionTypes on the account is hardened to AES-only. Step 4: Offline cracking. The captured tickets are formatted as $krb5tgs$23$* (RC4) or $krb5tgs$17$* / $krb5tgs$18$* (AES128/AES256) and fed to hashcat: hashcat -m 13100 hashes.txt rockyou.txt -r best64.rule for RC4, or -m 19700 / 19600 for AES variants. On commodity GPU hardware RC4 tickets crack at billions of hashes per second; an 8-character password from a common pattern (Season+Year, Company+Number) falls in under an hour. AES tickets are roughly two orders of magnitude slower but still cracked when the password is below 12 characters of mixed entropy. Step 5: Pass-the-password or kerberos-pre-auth. The attacker authenticates as the now-cracked service account: runas /netonly, Rubeus asktgt /user:svc_sql /password:Cracked123!, or simply uses the credentials against the service to pivot. If the account is in Domain Admins, the engagement is over. Step 6: Persistence. Real-world adversaries register a new SPN on a low-privilege account they already control (setspn -A) so they can Kerberoast on demand even after the initial path is closed. This adds an SPN to BloodHound that defenders rarely re-baseline.
Cómo lo evalúa Guerrilla
Guerrilla performs an LDAP search on the default naming context with filter (&(objectCategory=person)(objectClass=user)(servicePrincipalName=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) and the attribute set [servicePrincipalName, sAMAccountName, distinguishedName, userAccountControl, msDS-SupportedEncryptionTypes, pwdLastSet, memberOf, adminCount, lastLogonTimestamp, description]. The 1.2.840.113556.1.4.803 OID is the LDAP_MATCHING_RULE_BIT_AND used to exclude disabled accounts (UAC bit 0x2 = ACCOUNTDISABLE). Each returned object is enriched with three derived fields: the cracking cost class (RC4-permitted vs AES-only), the privilege tier (membership recursion through tokenGroups against well-known privileged SIDs S-1-5-32-544, S-1-5-21-*-512, S-1-5-21-*-518, S-1-5-21-*-519, S-1-5-21-*-520), and the password age in days computed from pwdLastSet. The check does not actually request service tickets, so it leaves no Event 4769 trail and cannot be distinguished from a benign read by a downstream IDS. For runtime detection, Guerrilla emits a paired recommendation to enable Audit Kerberos Service Ticket Operations (Success) and to alert on Event ID 4769 where Ticket Encryption Type = 0x17 (RC4) and Service Name does not match the per-account baseline, which is the canonical signal for an active Kerberoast.
Valor recomendado
Un mínimo de cuentas de usuario con SPN. Todas las cuentas vulnerables a Kerberoasting identificadas, documentadas con justificación de negocio y protegidas con contraseñas de 25 o más caracteres o migradas a gMSA.
Remediación
Enumera las cuentas vulnerables a Kerberoasting con Get-ADUser -Filter {ServicePrincipalName -ne '$null'} -Properties ServicePrincipalName. Para cada cuenta: (1) evalúa si el SPN sigue siendo necesario, (2) elimina los SPN innecesarios, (3) migra a Group Managed Service Accounts donde sea posible, (4) para las cuentas restantes asegura contraseñas de 25 o más caracteres rotadas con regularidad. Vigila las solicitudes TGS de Kerberos dirigidas a cuentas sensibles mediante el Event ID 4769.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1)
- ANSSI
- R36
- CIS AD Benchmark
- 7.1.1
- MITRE ATT&CK
- T1558.003