Active Directory Security: Mitigating Kerberoasting Attacks

In internal network systems, Kerberoasting is an extremely common post-exploitation technique used by attackers to compromise high-privilege service accounts.

---

How Kerberoasting Works

Kerberoasting exploits how the Kerberos protocol processes authentication.

• An attacker gains access to any Domain User account.
• The attacker requests a Service Ticket (TGS) from the Active Directory Domain Controller for any service associated with a Service Principal Name (SPN).
• The Domain Controller encrypts the ticket using the password hash of the target service account.
• The attacker extracts the ticket from memory and performs offline brute-force cracking using tools like Hashcat to recover the service account password.

---

Defense & Mitigation

1. Enforce Strong Password Policies: Service account passwords should exceed 25 characters, mitigating dictionary-based brute-force attacks.
2. Utilize Group Managed Service Accounts (gMSA): gMSAs feature 240-character passwords rotated automatically by Windows.
3. Monitor AD Traffic: Log anomalous requests for service tickets (TGS requests with weak encryption algorithms like RC4).