Suspicious Kerberos Ticket Request via PowerShell

This threat brief focuses on the exploitation of native .NET classes within PowerShell to perform unauthorized Kerberos ticket requests. Attackers frequently leverage the 'System.IdentityModel.Tokens.KerberosRequestorSecurityToken' class to interface with the Windows authentication stack and request service tickets for specific Service Principal Names (SPNs). This technique is a core component of 'Kerberoasting', where the resulting ticket can be exported and cracked offline to recover service account passwords. Detection depends on the visibility of PowerShell Script Block logging to capture the execution of these specific .NET method calls.

Attack Chain

1. Attacker establishes an initial foothold on a domain-joined host.
2. Attacker enumerates available services or user accounts via Active Directory queries.
3. Attacker identifies targets with Service Principal Names (SPNs) registered.
4. Attacker crafts a PowerShell script using 'System.IdentityModel.Tokens.KerberosRequestorSecurityToken'.
5. Attacker executes the script in the context of the current session to initiate a ticket request.
6. The .NET assembly interacts with the Kerberos Key Distribution Center (KDC).
7. The KDC issues the service ticket, which is stored in the memory of the current process.
8. Attacker extracts the service ticket for offline decryption (Kerberoasting).

Impact

Successful execution of this technique facilitates credential theft of high-privileged service accounts. Offline brute-forcing of these tickets allows attackers to obtain cleartext credentials, potentially leading to full domain compromise and lateral movement within the network.

Recommendation

Deploy the provided Sigma rule to your SIEM to monitor for the abuse of Kerberos request classes. Ensure PowerShell Script Block logging (Event ID 4104) is enabled globally across the enterprise, as this is the primary telemetry source for detecting this behavior.

• Deploy the Sigma rule below to detect unauthorized usage of the 'KerberosRequestorSecurityToken' class.
• Enable 'Log PowerShell Script Blocks' via Group Policy to ensure visibility into the specific .NET classes instantiated by scripts.
• Audit accounts with SPNs, specifically focusing on those with excessive privileges or service account permissions.