purple-team
2026-09Active Directory Kerberoasting: Attack Emulation & SIEM Detection
Simulated Kerberoasting (MITRE ATT&CK T1558.003) in an isolated Active Directory lab and engineered Splunk correlation searches around Windows Event ID 4769.
Attack: Enumerated domain SPNs and requested RC4-HMAC (0x17) TGS service tickets for offline hash cracking.
Detection: Correlated Windows Security Event ID 4769 filtering for Encryption Type 0x17 and Ticket Options 0x40810000 excluding computer accounts ($).
Mitigation: Enforced AES-256 encryption via Group Policy for service accounts and migrated vulnerable services to Group Managed Service Accounts (gMSA).