The scenario is fictional. Event details are from the book and not tested on a live domain. Detection only.
The hard part of Active Directory attacks: the logs look normal. Service ticket requests happen thousands of times a day. One of them is an attack, and the tell is a field most people ignore: the encryption type.
What you'll learn
- Why Kerberoasting looks normal
- The one field in Event 4769 that matters (
0x17, RC4) - Supporting signals: SPN count, requester, honeypot SPNs
- How it differs from AS-REP roasting and Golden/Silver tickets
The story at a glance
| Time | What happened |
|---|---|
| 09:12:40 | lsass access on WS01 |
| 09:13+ | Burst of 4769 on DC01 |
| Same | Requester svc_web, normally quiet |
| Same | Many SPNs, encryption type 0x17 (RC4) |
Reading 4769
Normal: jdoe, MSSQLSvc/db01.corp:1433, 0x12 (AES256). Suspicious: svc_web, many SPNs, 0x17 in an AES environment. A honeypot SPN (a fake service account nobody uses) makes any request a near-certain signal.
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4769} -MaxEvents 2000
(From the book; not run here. Filter on type, requester and SPN count.)
Siblings
| Attack | Event | Tell |
|---|---|---|
| Kerberoasting | 4769 |
0x17, many SPNs |
| AS-REP roasting | 4768 | pre-auth type 0
|
| Golden Ticket | 4769 | no matching 4768, abnormal lifetime |
| Silver Ticket | none on DC | needs service-side correlation |
Defense
Long service-account passwords (or gMSA), AES everywhere, honeypot SPNs.
Next: the night a domain controller replicated its own secrets.
Adapted from chapter 23 of my Japanese book on server defense.
Top comments (0)