Ghost SPN: A Stealthy Kerberoasting Technique Exploiting Active Directory Misconfigurations
Researchers at Trellix have uncovered a novel attack method dubbed Ghost SPN, which exploits misconfigured Active Directory (AD) service principal names (SPNs) to enable Kerberoasting a technique allowing attackers to extract and crack encrypted service account credentials offline.
How Ghost SPN Works
Traditional Kerberoasting (MITRE ATT&CK T1558.003) involves requesting Kerberos ticket-granting service (TGS) tickets for accounts with SPNs, as portions of these tickets are encrypted using the target account’s password hash. Attackers can then crack these hashes offline, particularly if passwords are weak or reused.
Ghost SPN takes this a step further by temporarily assigning an SPN to an ordinary user account, requesting a TGS ticket, and then removing the SPN before detection. This evasion tactic leverages delegated permissions to modify AD account objects, allowing attackers to:
- Briefly attach an SPN to a low-privilege account.
- Request a TGS ticket for the manipulated account.
- Harvest encrypted ticket data for offline cracking.
- Delete the SPN, minimizing forensic evidence.
The attack is particularly effective when RC4-HMAC encryption (type 0x17) is used, as RC4-derived keys are easier to crack than modern AES alternatives. Once obtained, the ticket can be exported and reused in pass-the-ticket attacks, enabling lateral movement without re-entering credentials.
Detection and Mitigation Challenges
Ghost SPN complicates detection by:
- Avoiding persistent changes SPNs are removed after ticket extraction.
- Bypassing traditional Kerberoasting defenses, which focus on privileged service accounts rather than ordinary users.
- Combining with other techniques, such as PowerShell abuse or credential dumping, to evade endpoint-based monitoring.
Microsoft recommends auditing user accounts for unexpected SPNs and restricting delegated permissions that allow SPN modifications outside formal change-management processes. Defenders should:
- Monitor Windows Event ID 4769 for RC4-encrypted TGS requests.
- Correlate unusual ticket requests with suspicious processes (e.g., LSASS access, credential dumping).
- Disable RC4 encryption where possible, enforce AES for service accounts, and use long, randomly generated passwords.
- Migrate services to Managed Service Accounts (MSAs) for centralized credential management.
The technique highlights the need for behavioral detection rather than reliance on single-event alerts, as Ghost SPN’s transient nature makes it harder to trace.
Source: https://cyberpress.org/active-directory-spn-flaws/
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security
"id": "mic1787898427",
"linkid": "microsoft-security",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'type': 'Organizations using Active Directory'}],
'attack_vector': 'Active Directory Misconfiguration',
'data_breach': {'data_encryption': 'RC4-HMAC (type 0x17)',
'sensitivity_of_data': 'High (if cracked, enables lateral '
'movement)',
'type_of_data_compromised': 'Service account credentials'},
'description': 'Researchers at Trellix uncovered a novel attack method dubbed '
'Ghost SPN, which exploits misconfigured Active Directory (AD) '
'service principal names (SPNs) to enable Kerberoasting, '
'allowing attackers to extract and crack encrypted service '
'account credentials offline. The technique involves '
'temporarily assigning an SPN to an ordinary user account, '
'requesting a TGS ticket, and then removing the SPN before '
'detection to evade forensic evidence.',
'impact': {'data_compromised': 'Encrypted service account credentials',
'identity_theft_risk': 'High (if credentials are cracked)',
'operational_impact': 'Potential lateral movement, privilege '
'escalation',
'systems_affected': 'Active Directory environments'},
'lessons_learned': 'The incident highlights the need for behavioral detection '
'over reliance on single-event alerts due to the transient '
'nature of Ghost SPN. Traditional Kerberoasting defenses '
'may not detect this technique as it targets ordinary user '
'accounts rather than privileged service accounts.',
'post_incident_analysis': {'corrective_actions': ['Restrict SPN modification '
'permissions',
'Disable RC4 encryption',
'Enforce AES for service '
'accounts',
'Implement behavioral '
'detection for transient '
'SPN assignments'],
'root_causes': 'Misconfigured Active Directory '
'SPNs, delegated permissions '
'allowing SPN modifications, use of '
'weak RC4-HMAC encryption'},
'recommendations': ['Audit user accounts for unexpected SPNs',
'Restrict delegated permissions for SPN modifications',
'Monitor Windows Event ID 4769 for RC4-encrypted TGS '
'requests',
'Correlate unusual ticket requests with suspicious '
'processes (e.g., LSASS access)',
'Disable RC4 encryption where possible and enforce AES '
'for service accounts',
'Use long, randomly generated passwords for service '
'accounts',
'Migrate services to Managed Service Accounts (MSAs) for '
'centralized credential management',
'Implement behavioral detection for transient SPN '
'assignments'],
'references': [{'source': 'Trellix Research'}],
'response': {'containment_measures': ['Monitor Windows Event ID 4769 for '
'RC4-encrypted TGS requests',
'Correlate unusual ticket requests with '
'suspicious processes',
'Disable RC4 encryption where possible',
'Enforce AES for service accounts',
'Use long, randomly generated passwords',
'Migrate services to Managed Service '
'Accounts (MSAs)'],
'enhanced_monitoring': 'Behavioral detection for transient SPN '
'assignments',
'remediation_measures': ['Audit user accounts for unexpected '
'SPNs',
'Restrict delegated permissions for SPN '
'modifications',
'Implement behavioral detection for '
'transient SPN assignments']},
'title': 'Ghost SPN: A Stealthy Kerberoasting Technique Exploiting Active '
'Directory Misconfigurations',
'type': 'Kerberoasting / Credential Theft',
'vulnerability_exploited': 'Misconfigured SPNs, delegated permissions, '
'RC4-HMAC encryption'}