Attacking Kerberos
Performing a Kerberoasting attack involves several steps, and attackers often use a variety of techniques to achieve their goals. To avoid detection, attackers may perform the attack in a stealthy manner, limiting the number of service ticket requests and ensuring that their actions do not trigger security alerts.
Here are some common techniques associated with Kerberoasting attacks:
- Identifying Service Accounts
The attacker identifies service accounts in the Active Directory environment. Service accounts are often associated with background services and are attractive targets due to their typically long and complex passwords.
- Enumerating Service Principal Names (SPNs)
Service Principal Names (SPNs) are associated with service accounts. Attackers may use tools like BloodHound or PowerView to enumerate and identify accounts with associated SPNs.
- Requesting Service Tickets
The attacker requests service tickets for the identified service accounts. They typically...
