Threat Hunting Exercise: Analyzing Windows Kerberoasting SPN Enumeration & Offline Cracking Dataset
This hunt uses a simulated Active Directory authentication dataset (windows_kerberoast_2022-08-02T141500.json) capturing T1558.003: Kerberoasting, where an attacker enumerates Service Principal Names (SPNs) via LDAP and requests Kerberos service tickets encrypted with the target service account's password hash for offline cracking.
Step 1: Hypothesis Formation
Hypothesis: A standard domain user account requests Kerberos service tickets (TGS-REQ) for an unusually large number of distinct SPNs in a short window, followed by no corresponding legitimate application activity. Indicators:
- A single low-privilege account requesting TGS tickets for 10+ distinct SPNs within minutes.
- LDAP queries immediately preceding the TGS requests, filtering on
servicePrincipalName=*. - Tickets requested using weaker encryption (RC4-HMAC, etype 0x17) despite AES being available - a common Kerberoasting tool default.
- No corresponding client application launch or service connection following ticket issuance.
Null Hypothesis: An administrator or monitoring tool is running a legitimate SPN inventory/audit script that also requests tickets for validation purposes. Invalidate by identifying the source process and confirming it against an approved change ticket or scheduled task inventory.
Rationale: Kerberoasting lets an attacker escalate from a low-privileged foothold to a service account's plaintext password entirely offline, without ever touching the target service - this hunt validates ticket-encryption-type and request-volume analytics as an offline-cracking-resistant detection layer.
Step 2: Data Sources and Scope
- Sources: Domain Controller Security Event Logs (4769 - Kerberos Service Ticket Requested); LDAP query logs / Directory Service Access auditing (4662); EDR process telemetry for the requesting host.
- Scope: ~2022-08-02T14:15:00-14:22:00 UTC; Host: WKS-FIN-044 (10.140.2.19); Account: svc-reports (member of Domain Users only).
- SIEM Queries (Splunk/ELK):
index=wineventlog EventCode=4769 Account_Name="svc-reports" | stats dc(Service_Name) as distinct_spns by Account_Name, bucket(_time,10m) | where distinct_spns>10- Weak encryption filter:
index=wineventlog EventCode=4769 Ticket_Encryption_Type="0x17" | stats count by Account_Name, Service_Name - LDAP SPN enumeration:
index=wineventlog EventCode=4662 Properties="servicePrincipalName" | stats count by Account_Name, Client_Address
Step 3: Key Findings
Parsed events (6 shown) confirm the account svc-reports requested 27 TGS tickets for distinct SPNs within 7 minutes, all using RC4-HMAC encryption, immediately following an LDAP SPN sweep.
| Timestamp (UTC) | Host | Event | Encryption/Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-08-02 14:15:02 | WKS-FIN-044 | 4662 (LDAP search: servicePrincipalName=*) | - | Recon IOC: a full-domain SPN enumeration query from a standard user account - not a behavior seen in normal application logons. |
| 2022-08-02 14:16:10 | WKS-FIN-044 | 4769 - SQLSvc/db01.corp.local | 0x17 (RC4-HMAC) | Weak-Crypto IOC: RC4 requested despite the domain functional level supporting AES - the classic Rubeus/Impacket default. |
| 2022-08-02 14:16:11 - 14:22:00 | WKS-FIN-044 | 4769 (26 additional distinct SPNs) | 0x17 for all 26 | Volume IOC: 27 distinct service tickets requested by one account in 7 minutes - far exceeds any single legitimate application's ticket needs. |
| 2022-08-02 14:22:15 | WKS-FIN-044 | (EDR process check) | rubeus.exe launched from C:\Users\Public\ | Tooling IOC: known Kerberoasting tool binary confirms malicious intent, not an audit script. |
| - | - | (account context) | svc-reports: standard domain user, never logs on interactively | Corroborates that the requesting principal has no legitimate reason to enumerate or roast services. |
| - | - | (follow-up) | No corresponding SMB/application connections after ticket issuance | No legitimate consumption of the tickets - consistent with tickets extracted for offline cracking rather than use. |
Validation:
- Timeline: LDAP SPN sweep immediately followed by 27 RC4-encrypted TGS requests in 7 minutes - textbook Kerberoasting tempo.
- False Positives: No scheduled audit task or change record explains this account's activity; the requesting binary is a known offensive-security tool, not an approved administrative script.
- Correlation: Single account, single host, encryption-type and volume both statistically abnormal - high confidence Kerberoasting.
Step 4: Recommendations & Next Steps
- Immediate Response: Disable/reset the
svc-reportsaccount password immediately; force AES-only Kerberos policy where feasible; isolate WKS-FIN-044 for forensic triage; audit all service accounts for weak/reused passwords via an authorized password-spraying/roasting simulation. - Detection: Sigma-style rule:
title: Kerberoasting - High Volume RC4 TGS Requests→selection: EventID=4769 AND Ticket_Encryption_Type="0x17" | distinct_spns_per_account_10m > 8. - Pro Tip: Enforce AES256 on all service accounts and enroll them in Group Managed Service Accounts (gMSA) - this removes the static, crackable password that makes Kerberoasting viable in the first place.
Hypothesis confirmed - a compromised standard user account performed SPN enumeration and roasted 27 service tickets for offline password cracking!