The following security controls should be implemented to mitigate Kerberoasting:
Minimise the number of user objects configured with SPNs. This reduces the attack surface for malicious actors to execute Kerberoasting.
Create user objects with SPNs asgroup Managed Service Accounts (gMSAs). gMSAs have automatic password rotation, a 120-character password and simplified SPN management. These security features protect the password from being cracked, reducing the likelihood of successful Kerberoasting. However, if creating user objects with SPNs as gMSAs is not feasible, for example, it is a non-Windows based system hosting the service, or the application does not fully support gMSAs, such as Microsoft’s System Center Configuration Manager, set a minimum 30-character password that is unique, unpredictable and managed.
Assign user objects with SPNs the minimum privileges necessary to perform their functions and make sure they are not members of highly privileged security groups, such as the Domain Admins security group. If malicious actors successfully execute Kerberoasting and crack the TGS ticket to reveal the cleartext password, minimising the privileges assigned to the user object will reduce the impact and limit the access gained by the malicious actor.
Infrastructure Attack Strategies for Ethical Hacking
Encompassing both external and internal enumeration techniques, the book delves into attacking routers and services, establishing footholds, privilege escalation, lateral movement, and exploiting databases and Active Directory.
