purple-teamMITRE T1558.003 MITRE T1087.0022026-09

Active Directory Kerberoasting: Attack Emulation & SIEM Detection

Simulated Kerberoasting (MITRE ATT&CK T1558.003) in an isolated Active Directory lab and engineered Splunk correlation searches around Windows Event ID 4769.

#Active Directory #Splunk #MITRE T1558.003 #Kerberos #Rubeus #Detection Engineering

43 views

Attack Vector (Red)

Enumerated domain SPNs and requested RC4-HMAC (0x17) TGS service tickets for offline hash cracking.

Detection Logic (Blue)

Correlated Windows Security Event ID 4769 filtering for Encryption Type 0x17 and Ticket Options 0x40810000 excluding computer accounts ($).

Hardening & Mitigation

Enforced AES-256 encryption via Group Policy for service accounts and migrated vulnerable services to Group Managed Service Accounts (gMSA).

Case Study & Technical Notes

A Purple Team lab exercise designed to evaluate how service accounts with weak SPN configurations are targeted during internal assessments and how defenders can reliably spot ticket-granting service (TGS) encryption downgrades.

bash

# Requesting RC4-encrypted TGS tickets for domain SPNs
Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt

During the defensive phase, Windows Security Event ID 4769 logs were forwarded into Splunk and filtered for encryption type 0x17 (RC4-HMAC) and anomalous ticket options, separating legitimate administrative activity from extraction attempts.

spl

index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17 Ticket_Options=0x40810000 Account_Name!="*$"
| table _time, Account_Name, Service_Name, Client_Address, Ticket_Encryption_Type

View on GitHub