PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Remove SPNs and Fix Kerberoasting

projectblack.io | research | #remediation | #active-directory | #privilege-escalation | #hardening | #kerberoasting | #spn
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Kerberoasting remediation guide: check whether an SPN is still in use via Event ID 4769, then remove unneeded SPNs with setspn or ADUC. Also covers the impact of deleting actively used SPNs.
Published
Collected

Related coverage

blog · semperis.com
AD Group Risks: How Cryptographic Operators Dangers Escalate Quickly
At first glance, the Cryptographic Operators group doesn’t look scary. But it sits dangerously close to the systems that define trust—and in Windows, trust is everything. Here’s how to head off risk in your environment.
blog · semperis.com
Active Directory Attacks: 5 Common AD Attack Methods
An updated classic on AD's structural weaknesses—legacy defaults built for discovery, easily enumerated privileged groups—and five common attack methods, with countermeasures for protection.
blog · semperis.com
Active Directory Hardening Best Practices
Nearly half of Microsoft IR engagements found unsecure AD configurations; Mandiant says 9 in 10 attacks exploit AD. Covers recon via PowerView and BloodHound, key techniques, and hardening priorities.
blog · semperis.com
How to Protect Active Directory Against Kerberoasting: AD Security 101
Kerberoasting explained: any authenticated user can request service tickets encrypted with weak RC4/DES service-account hashes and crack them offline. Covers Kerberos/SPN basics and defenses.
vulnerability · horizon3.ai
From CVE-2022-33679 to Unauthenticated Kerberoasting
On September 13, 2022, a new Kerberos vulnerability was published on the Microsoft Security Response Center’s security site. It’s labeled as a Windows Kerberos…
blog · netspi.com
Locate and Attack Domain SQL Servers without Scanning
Any domain user can query AD SPN records to enumerate every SQL Server—instances and ports included—without noisy scans; NetSPI's Get-SQLServerAccess module then tests each for accessible logins.
Back