Ghost SPN Attack Lets Hackers Conduct Stealthy Kerberoasting Under the Radar
The "Ghost SPN" attack represents an advanced variant of the Kerberoasting technique, enabling attackers to extract Active Directory credentials without leaving detectable traces. This attack circumvents conventional detection mechanisms by exploiting…
The "Ghost SPN" attack represents an advanced variant of the Kerberoasting technique, enabling attackers to extract Active Directory credentials without leaving detectable traces. This attack circumvents conventional detection mechanisms by exploiting delegated administrative permissions to create temporary exposure windows.
Kerberoasting targets Active Directory (AD) accounts with Service Principal Names (SPNs). When a Ticket Granting Service (TGS) ticket is requested for an SPN, the Kerberos Key Distribution Center (KDC) encrypts it using the target account's NTLM hash. Attackers can extract and crack this offline to recover plaintext credentials.
The Ghost SPN attack further exploits delegated directory permissions, such as GenericAll object-level write access, to temporarily assign a fake SPN to a standard user account. This transforms the user into a temporary Kerberoasting target without triggering enumeration-based alerts.
SPN Assignment (Out-of-Band): Attackers use write access to assign an arbitrary SPN (e.g., http/webapp ) to a target account via PowerShell. The KDC issues a TGS ticket encrypted with RC4-HMAC-MD5, which appears as standard Kerberos behavior.
Extraction and Offline Cracking: The TGS ticket is dumped with tools like Mimikatz and exported as a .kirbi file. Cracking occurs outside the environment using tools such as Hashcat, generating no authentication failures within the target infrastructure.
Cleanup and Anti-Forensics: The SPN attribute is cleared, restoring the account to its original state. Without persistent indicators, defenders cannot link the TGS request to malicious behavior.
This attack circumvents conventional detection mechanisms by exploiting delegated administrative permissions to create temporary exposure windows.
This technique undermines detection models that assume Kerberoasting targets are pre-registered service accounts and that malicious activity produces high-volume ticket request anomalies. The SPN may exist only briefly, making the activity indistinguishable from legitimate administrative actions.
Organizations should adopt the following measures:
Audit ACLs aggressively — Identify and revoke GenericAll or WriteSPN permissions for non-administrative accounts.
Enable granular AD change logging — Correlate msDS-ServicePrincipalName attribute modifications with Kerberos ticket requests.
Enforce AES-only Kerberos encryption — Eliminate RC4-HMAC-MD5 to reduce vulnerability to offline cracking.
Reset compromised account passwords — Focus on accounts with historical write-access exposure to privileged objects.
Deploy behavioral NDR tooling — Static signature matching and SIEM-only approaches are insufficient to detect ephemeral identity manipulation.
As adversaries increasingly exploit legitimate directory permissions, defenders must focus on continuous surveillance of identity attribute changes.
Based on reporting by Cyber Security News.