Kerberoasting is a sophisticated attack technique that targets service accounts within Active Directory environments to extract and crack their passwords. This method falls under the broader tactic of Credential Access (T1558.003) and poses a significant threat to organisations, particularly those that rely heavily on Kerberos for authentication. Given the high severity of this threat, it is crucial for security teams to understand how Kerberoasting works, how to detect it, and the necessary mitigation strategies to protect their environments.
How It Works
Kerberoasting exploits the way Kerberos authentication operates within Active Directory. When a user requests access to a service, they obtain a Ticket Granting Service (TGS) ticket from the Key Distribution Centre (KDC). This ticket contains a service principal name (SPN) and is encrypted with the service account's password hash. Attackers can request TGS tickets for service accounts, even if they do not have the credentials for those accounts.
Once the attacker has the TGS ticket, they can extract the encrypted portion and attempt to crack it offline using various tools like Hashcat or John the Ripper. The effectiveness of this attack largely depends on the strength of the service account passwords. Weak or easily guessable passwords can be cracked in a matter of hours or even minutes, granting attackers access to critical services and data.
Real-World Scenario
Consider an organisation that has multiple service accounts with weak passwords. An attacker, having gained initial access to the network, enumerates the service accounts and identifies those with SPNs. They then initiate a Kerberoasting attack by requesting TGS tickets for these accounts. After extracting the tickets, the attacker uses a password-cracking tool to recover the plaintext passwords. With these credentials, they can escalate privileges, move laterally within the network, and potentially exfiltrate sensitive data.
Detection
Detecting Kerberoasting attempts requires monitoring for specific indicators within your environment. Key logs and alerts to focus on include:
-
Event ID 4769: This event logs TGS ticket requests. An unusual volume of these requests, especially for service accounts that are not frequently accessed, may indicate a Kerberoasting attempt.
-
High Volume of SPN Enumeration: Monitor for LDAP queries that enumerate SPNs. A sudden spike in these queries can suggest that an attacker is scanning for potential targets.
-
Service Ticket Requests for Unused Services: Regularly review service accounts and their usage. If there are TGS requests for accounts associated with services that are not in use, this could signal malicious activity.
Log Analysis Example
Utilising PowerShell to query the Security event log can help identify potential Kerberoasting activities:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769} |
Where-Object { $_.Properties[0].Value -like '*<ServiceAccountName>*' } |
Select-Object TimeCreated, @{Name='SPN'; Expression={ $_.Properties[1].Value }}
This script retrieves TGS ticket requests for a specified service account, allowing security teams to quickly identify anomalous activity.
Mitigation
To defend against Kerberoasting, organisations should implement several key measures:
-
Strong Service Account Passwords: Enforce a policy requiring service account passwords to be at least 25 characters long, incorporating a mix of uppercase letters, lowercase letters, numbers, and special characters. This significantly increases the time required to crack these passwords.
-
AES Encryption Enforcement: Ensure that your Kerberos implementation uses AES encryption. This is more secure than the older DES encryption and makes it more difficult for attackers to crack tickets.
-
Service Account Password Rotation Policies: Regularly rotate service account passwords to limit the window of opportunity for attackers. Implement a policy that requires password changes at least every 60-90 days.
-
Limit Service Account Privileges: Apply the principle of least privilege to service accounts. Ensure they only have the permissions necessary for their function and disable any unused accounts.
Recommended Actions
To effectively respond to a suspected Kerberoasting incident, security teams should follow this step-by-step plan:
-
Initial Investigation: Review security logs for Event ID 4769 and other indicators of Kerberoasting. Identify the source of the requests and the accounts involved.
-
Containment: If a compromise is suspected, isolate the affected accounts and services. Disable or restrict access to service accounts that are implicated in the attack.
-
Password Reset: Immediately reset passwords for any compromised service accounts, ensuring they meet the strength requirements outlined above.
-
Conduct a Forensic Analysis: Investigate the extent of the breach, including lateral movement and data exfiltration. Use forensic tools to gather evidence and understand the attack vector.
-
Review and Update Security Policies: After addressing the immediate threat, review your security policies and practices. Update your incident response plan to incorporate lessons learned from the incident.
-
User Education: Conduct training sessions for users and administrators on the importance of strong passwords and recognising potential signs of compromise.
By implementing these measures and maintaining vigilance, organisations can significantly reduce their risk of falling victim to Kerberoasting attacks.
In conclusion, Kerberoasting poses a serious threat to organisations leveraging Active Directory for authentication. By understanding how this attack works, implementing robust detection mechanisms, and enforcing strong mitigation strategies, security teams can protect their environments from credential theft. For further assistance in fortifying your cybersecurity posture against Kerberoasting and other threats, contact CyberZonic today. Our experts are ready to help you enhance your security measures and safeguard your organisation.