Kerberoasting
Kerberoasting is a post-exploitation technique used by attackers to extract service account credentials from a Windows environment. The technique exploits the Kerberos authentication protocol, which is widely used in Windows networks for authenticating service requests between trusted hosts. By obtaining service account credentials, attackers can escalate privileges and move laterally within a network. As of October 2023, Kerberoasting remains a prevalent threat due to its effectiveness and the difficulty of detection.
Overview
Kerberoasting is a technique that targets the Kerberos authentication protocol, specifically focusing on service account tickets. Attackers request service tickets for accounts with Service Principal Names (SPNs), which are then extracted and subjected to offline brute-force attacks to reveal plaintext passwords. This technique is particularly effective against accounts with weak or easily guessable passwords. Kerberoasting is often used in conjunction with other techniques to achieve [lateral movement] within a network.
How it works
Kerberos is an authentication protocol that uses tickets to allow nodes to prove their identity over a non-secure network. In a typical Kerberos authentication process, a client requests a ticket-granting ticket (TGT) from the Key Distribution Center (KDC). Once the TGT is obtained, the client can request service tickets for specific services.
In Kerberoasting, an attacker with access to a network requests service tickets for accounts with SPNs. These tickets are encrypted with the service account's password hash. The attacker can then extract these tickets and perform offline brute-force attacks to crack the password hash, revealing the plaintext password. This process does not generate suspicious network traffic, making it challenging to detect.
Observed use
Kerberoasting has been observed in various cyberattacks, often as part of a broader strategy to gain elevated privileges within a network. It is commonly used by threat actors after gaining initial access to a network, allowing them to escalate privileges and conduct further malicious activities. Security researchers have noted its use in both targeted attacks and opportunistic campaigns, highlighting its versatility and effectiveness.
Detection
Detecting Kerberoasting can be challenging due to its reliance on legitimate Kerberos requests. However, certain indicators can suggest its use:
- Unusual service ticket requests: Monitoring for an unusually high number of service ticket requests, especially for accounts with SPNs, can indicate potential Kerberoasting activity.
- Event log analysis: Reviewing Windows event logs for anomalies, such as Event ID 4769 (Kerberos Service Ticket Operations), can help identify suspicious activity.
- Network traffic analysis: Analyzing network traffic for patterns associated with Kerberoasting, such as repeated requests for service tickets, can aid in detection.
Mitigation
Mitigating Kerberoasting involves a combination of preventive measures and security practices:
- Strong password policies: Implementing strong, complex passwords for service accounts reduces the risk of successful brute-force attacks.
- Regular password changes: Frequently changing service account passwords can limit the window of opportunity for attackers.
- Service account management: Minimizing the number of accounts with SPNs and ensuring they have the least privileges necessary can reduce the attack surface.
- Monitoring and alerting: Implementing robust monitoring and alerting mechanisms to detect unusual Kerberos activity can help in early detection and response.