Detection of PowerView Kerberoasting via Get-DomainSPNTicket

The PowerView tool, a widely used PowerShell-based framework for Active Directory enumeration and exploitation, includes the Get-DomainSPNTicket cmdlet specifically designed to facilitate Kerberoasting. Kerberoasting is a well-documented technique where attackers request Kerberos service tickets for services associated with Service Principal Names (SPNs). Because the service ticket is encrypted with the service account's NTLM hash, it can be exported from memory and subjected to offline brute-force attacks to recover the cleartext password.

This activity is commonly observed during the post-exploitation phase of an intrusion, enabling attackers to escalate privileges or move laterally by compromising service accounts that often possess high-level permissions. Detection relies on monitoring PowerShell Script Block Logging (Event ID 4104) for the execution of specific PowerView commandlets, which provides visibility into the intent of the attacker even when commands are obfuscated or run in-memory.

Attack Chain

1. Attacker achieves initial execution on an endpoint within the Active Directory domain.
2. Attacker loads the PowerView framework into the current PowerShell session.
3. Attacker identifies targets by enumerating SPNs within the domain.
4. Attacker executes Get-DomainSPNTicket to request service tickets from the Domain Controller.
5. The Domain Controller issues the requested service tickets to the compromised endpoint.
6. Attacker exports the received tickets from the local cache or memory using tools like Mimikatz or built-in PowerShell commands.
7. Attacker exfiltrates the tickets to an attacker-controlled machine.
8. Attacker performs offline cracking of the extracted hashes to recover service account credentials.

Impact

Successful Kerberoasting can lead to the compromise of highly privileged service accounts, such as those running MSSQL or other critical infrastructure services. This often results in full domain compromise, as these accounts frequently possess high-level privileges in Active Directory. The technique is a common precursor to ransomware deployment and large-scale data exfiltration, as observed in various incidents including the Rhysida ransomware campaigns.

Recommendation

1. Enable PowerShell Script Block Logging (Event ID 4104) across all domain-joined endpoints to capture command execution details.
2. Deploy the provided Sigma rule to detect the execution of Get-DomainSPNTicket within your SIEM environment.
3. Proactively monitor for unauthorized use of PowerView by administrators and investigate alerts generated by the use of this toolkit by non-admin accounts.
4. Implement strict password policies and consider transitioning to Group Managed Service Accounts (gMSA) to mitigate the impact of Kerberoasting, as these accounts use long, complex, and automatically rotated passwords.