Why Kerberoasting Still Works. And How to Stop It

Although Kerberoasting has been extensively documented and is widely acknowledged by security experts, it continues to evade detection in numerous contexts. Because Kerberoasting is stealthy and leverages approved protocols, attackers who seek lateral movement and privilege escalation still find value.

Kerberoasting is a particular kind of post-exploitation attack that targets AD’s Kerberos authentication system. It enables attackers to obtain service account credentials without the need for elevated access or malware. For accounts associated with Service Principal Names (SPNs), the attack exploits the ability of any authorised domain user to make service ticket requests. In order to recover plaintext credentials, attackers can attempt to brute force these tickets offline using the password hash for the service account.

Here’s a detailed breakdown of the Kerberoasting attack process:

1. Initial Access: The hacker enters the network by breaching a legitimate domain user account. Phishing attempts, system flaws, or the use of previously acquired credentials are frequently used to accomplish this. Importantly, any authenticated domain user can start the next stages; the hijacked account doesn’t need elevated privileges.
2. SPN Enumeration: Service Principal Names (SPNs) within the domain are enumerated by the attacker using programs such as PowerShell’s Get-ADUser. Service accounts in Active Directory are uniquely identified by SPNs. Due to their association with services that can be targeted for Kerberoasting, identifying these accounts is essential.
3. Requesting Service Tickets: The attacker requests Kerberos Ticket Granting Service (TGS) tickets for the SPNs that have been identified. The hash of the service account password is used to encrypt these tickets. Since these tickets can be requested by any authenticated user, the attacker can get them without immediately raising suspicion.
4. Extracting Tickets: The process of extracting TGS tickets from the system’s memory or Kerberos ticket cache involves the use of tools. The extraction procedure is facilitated by these tools, which enable the attacker to store the tickets for offline examination.
5. Offline Cracking: Using various programs offline, brute-force or dictionary assaults are applied to the recovered tickets, with the goal of recovering the plaintext passwords for service accounts. Because this process is carried out offline, the chance of discovery is reduced.
6. Privilege Escalation: The attacker may be able to spoof these accounts and obtain higher privileges within the network by using the compromised service account credentials. This access makes it possible to move laterally and exfiltrate data.

Despite the potentially disastrous nature of Kerberoasting, most organizations fail to detect it for the following main reasons:

1. Uses Legitimate Kerberos Functionality: Attackers and other domain users routinely request a TGS for an SPN. Malicious and authentic ticket requests are indistinguishable since the Key Distribution Centre (KDC) just reacts as usual. Event 4769 logs are generated in large volumes by Windows environments. Most SOCs just consider a surge in TGS requests to be noise, therefore identifying it needs sophisticated baselining.
2. No Elevated Privileges or Malware Required: There is no need for malware or elevated privileges. Frequently, SOC teams lack in-depth knowledge of Active Directory internals. Ticket encryption types, ticket choices, and SPN properties may not be recorded in logs.
3. Low SOC Visibility: Most SOC teams have limited access to AD internals and will begin removing useless alarms. SIEMs are not able to identify suspicious behavior, such as RC4 encryption use or excessive TGS requests from one server. SIEMs create thousands of Kerberos logs a day. Without some distinctly anomalous rules (increases in TGS requests, and RC4 usage, etc.) malicious activity gets lost in the mix.
4. Weak Encryption: In many cases, RC4-HMAC encryption, a particular encryption technique used in Kerberos, is still allowed in older Windows settings. Its reduced resistance makes it easier for attackers to issue an RC4 ticket (dry run request) and then crack it. Passwords for service accounts often remain unchanged for years. When used in conjunction with RC4, this makes password cracking reliable and efficient.
5. Lack of Behavioral Detection: Attackers can take advantage of the absence of behavior-aware monitoring. Many SIEMs are unable to identify Kerberoasting, which involves requesting dozens of SPNs in a matter of minutes, something that legitimate users hardly ever perform. A lot of teams just lack the manpower and resources necessary to properly analyse large volumes of Kerberos logs and construct behavioural detection systems around them.