Detecting and preventing Kerberoasting
In the security log you separate service ticket events (4769) by encryption type, find the account that requested RC4 tickets for many services in a short time and turn the detection into a script; in the directory you audit the encryption types and password ages of accounts with SPNs, list the accounts that still accept RC4 and write the prevention plan. The attacking account, source address and hardened account differ in every lab.
Level 201 · 50 min
Kerberoasting works like this: any user in the domain may request a service ticket for a service account that has an SPN. Part of the ticket is encrypted with a key derived from that service account’s password. The attacker takes the ticket to their own computer and tries to guess the password offline. Not a single failed logon reaches the DC, which is why it is a quiet attack.
Quiet, but it leaves traces: every ticket request produces a 4769 event on the DC. Attackers ask for RC4-encrypted tickets because they are easy to crack (TicketEncryptionType 0x17); modern clients use AES (0x12). One account requesting RC4 tickets for many services in a short time is the signature of Kerberoasting. The figure shows these signs.
In this lesson you join two halves: you find the attack in the log (~/logs/security.jsonl) and audit in the directory which accounts are still exposed. The attack steps (requesting and cracking tickets) are not this lesson’s subject; the goal is detection and prevention. About 30 seconds after the lab starts, this lab’s directory changes are in place.
What you will do in this lesson
- Which encryption do the service tickets use?
- A closer look at the RC4 tickets
- How many services per account?
- What else did this address do?
- The targets in the directory: accounts with SPNs
- Those that still accept RC4
- Write a detection rule
- The list of exposed accounts
- The response and prevention plan
- Short quiz
Skills you will earn
- Detecting Kerberoasting in service ticket events (4769, 0x17)
- Reading and counting a security log with jq
- Answering who, whom, from where and when for an incident
- Auditing accounts with SPNs exposed to Kerberoasting
- Auditing the encryption types of accounts with SPNs (msDS-SupportedEncryptionTypes)
- Turning a detection into a script
- Planning defences against Kerberoasting (AES, gMSA, long passwords)
- Writing audit findings into a report
← Detecting password spraying · Active Directory security: auditing and hardening · DCSync and the abuse of replication rights →
Start for free