Lesson 2.11: Service accounts and Kerberoasting
Any domain user can request a Kerberos service ticket for any account that has a service principal name (SPN), and part of that ticket is encrypted with the account's password. Attackers request tickets for every service account and try to crack them offline: Kerberoasting. Old, human-chosen passwords and RC4 encryption make it easy; a service account in Domain Admins makes it catastrophic. In the lab you list Northwind's SPN accounts, find the privileged and weak ones, detect last night's ticket burst in the DC log, and remove the worst risks.
18 min
You will learn to
- Explain SPNs and Kerberoasting
- Find user accounts with SPNs
- Spot privileged and weak service accounts
- Detect Kerberoasting in 4769 events
- Mitigate with gMSA, AES and least privilege
Key terms
- SPN
- Service principal name: the identifier Kerberos uses for a service, registered on the account that runs it.
- Kerberoasting
- Requesting service tickets for SPN accounts and cracking the account passwords offline.
- gMSA
- Group managed service account: AD generates a 120-character password and rotates it automatically; only allowed servers can retrieve it.
- msDS-SupportedEncryptionTypes
- Bitmask of Kerberos encryption types an account accepts: 4 RC4, 8 AES-128, 16 AES-256.
- pwdLastSet
- When the account's password was last set, as FILETIME.
← The same-origin policy and CORS · All lessons · Sysmon and process trees →