SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Identity, authentication and credential attacks

Kerberoasting

SPN service tickets requested and cracked offline for service passwords

categoryIdentity, authentication and credential attacksseverityHighdetectabilityHighlabnot yet measured

Classification

21 values: 9 reviewed, 8 imported, 4 derived. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Confidentiality
Platform	Windows
Environment	On-premises
Target asset class	Identity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Active Directory Credential RequestLogon Session CreationLogon Session MetadataProcess Access

Detection & response

Mitigated by 24

M1026 attack-mitigation
M1027 attack-mitigation
M1041 attack-mitigation
D3-ANCI d3fend
D3-APCA d3fend
D3-CCSA d3fend
D3-CH d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CSPP d3fend
D3-CTS d3fend
D3-DUC d3fend
D3-MFA d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RIC d3fend
D3-RTA d3fend
D3-RTSD d3fend
D3-TB d3fend
D3-TBA d3fend
D3-UGLPA d3fend

Detected by 19

DET0157 attack-detection-strategy
12827a56-61a4-476a-a9cb-f3068f191073 sigma
12e6d621-194f-4f59-90cc-1959e21e69f7 sigma
1eeed653-dbc8-4187-ad0c-eeebb20e6599 sigma
3245cd30-e015-40ff-a31d-5cadd5f377ec sigma
44bbff3e-4ca3-452d-a49a-6efa4cafa06f sigma
496a0e47-0a33-4dca-b009-9e6ca3591f39 sigma
503fe26e-b5f2-4944-a126-eab405cc06e5 sigma
6daac7fc-77d1-449a-a71a-e6b4d59a0e54 sigma
7ec2c172-dceb-4c10-92c9-87c1881b7e18 sigma
a7664b14-75fb-4a50-a223-cb9bc0afbacf sigma
a861d835-af37-4930-bcd6-5b178bfb54df sigma
b1e0b3f5-b62e-41be-886a-daffde446ad4 sigma
caa9a802-8bd8-4b9e-a5cd-4d6221670219 sigma
d04ae2b8-ad54-4de0-bd87-4bc1da66aa59 sigma
e3f7c841-2a9d-4b5e-c018-d94b3e67f012 sigma
e80a0fee-1a62-4419-b31e-0d0db6e6013a sigma
e96253b8-6b3b-4f90-9e59-3b24b99cf9b4 sigma
eca91c7c-9214-47b9-b4c5-cb1d7e4f2350 sigma

Tested by 7

14625569-6def-4497-99ac-8e7817105b55 atomic
29094950-2c96-4cbd-b5e4-f7c65079678f atomic
3f987809-3681-43c8-bcd8-b3ff3a28533a atomic
78d10e20-c874-45f2-a9df-6fea0120ec27 atomic
902f4ed2-1aba-4133-90f2-cff6d299d6da atomic
988539bc-2ed7-4e62-aec6-7c5cf6680863 atomic
e6f4affd-d826-4871-9a62-6c9004b8fe06 atomic

Attack relationships

Parent: Constrained delegation / S4U abuse
Parent: Resource-based constrained delegation (RBCD)
Parent: Unconstrained delegation abuse

Framework references

Primary source: https://attack.mitre.org/techniques/T1558/
attack: T1558.003 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 322 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 12 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)