Ghost SPN Attack Exploits Active Directory Flaws for Stealthy Kerberoasting Credential Theft

Threat actors are increasingly abusing overlooked Active Directory service principal name (SPN) configurations to make ordinary domain accounts vulnerable to Kerberoasting.

Security researchers at Trellix have dubbed the technique Ghost SPN, highlighting a stealthier approach in which attackers can temporarily assign an SPN to a user account, request a Kerberos service ticket, and then remove the SPN before defenders can easily identify the directory modification.

Kerberoasting, tracked by MITRE ATT&CK as T1558.003, allows an attacker with a valid Kerberos ticket-granting ticket to request service tickets for accounts associated with SPNs.

Ghost SPN Attack Exploits

Portions of these tickets are encrypted using cryptographic keys derived from the target account’s password hash. Attackers can extract the encrypted material and perform password cracking offline, potentially at scale and without repeatedly interacting with the victim environment.

This makes Kerberoasting particularly dangerous because the password-cracking phase does not require continuous authentication attempts against Active Directory.

Unlike conventional online password guessing, offline cracking does not generate repeated failed logons or trigger account lockouts.

Weak, predictable, or reused passwords can therefore eventually expose credentials that attackers can use for lateral movement, privilege escalation, or additional access within the domain.

SPNs normally identify services operating through Kerberos, including SQL Server, HTTP applications, and LDAP-based services.

Because SPNs are commonly associated with dedicated service identities, security teams frequently concentrate their audits on privileged service accounts.

Ghost SPN attacks exploit this assumption by abusing delegated permissions that allow an account object to be modified. An attacker who obtains sufficient directory permissions may attach a legitimate-looking SPN to an otherwise ordinary user account.

Once the directory accepts the new SPN, the attacker can request a Ticket Granting Service (TGS) ticket for that user identity.

The resulting ticket provides the encrypted material required for offline password-cracking attempts. Critically, the attacker can subsequently remove the temporary SPN, reducing the persistence of the directory modification and making retrospective investigation more difficult.

Trellix researchers describe this temporary exposure as an important element of the technique because attackers can operate outside normal administrative workflows.

The risk becomes greater when Kerberos uses RC4-HMAC (encryption type 0x17). RC4-derived keys are generally more attractive to attackers attempting offline password cracking than modern AES-based Kerberos encryption.

If the recovered credentials belong to an account with meaningful permissions, a seemingly minor SPN manipulation can become a stepping stone toward broader domain compromise.

Captured Kerberos tickets may also potentially support pass-the-ticket activity, allowing attackers to authenticate using ticket material rather than repeatedly supplying the account password.

Defending against Ghost SPN requires organizations to expand their view of Kerberoasting beyond conventional service accounts.

Security teams should regularly audit user objects for unexpected SPNs and investigate delegated Active Directory permissions that allow accounts to modify other account objects or SPN-related attributes.

Organizations should also identify SPN changes that occur outside approved administrative and change-management processes.

Detection should focus on correlated behavior rather than isolated Kerberos events. Windows Event ID 4769 can help identify suspicious TGS requests, particularly requests involving RC4 encryption, unusual request volumes, or service tickets inconsistent with established application behavior.

These events should be correlated with abnormal directory modifications, suspicious PowerShell activity, credential-dumping behavior, LSASS access, and other indicators associated with identity compromise.

Organizations can further reduce exposure by migrating eligible services to Group Managed Service Accounts (gMSAs) or other managed service identities that eliminate the need for manually maintained passwords.

Where managed accounts are not practical, service credentials should use long, randomly generated passwords, while AES-based Kerberos encryption should be preferred and RC4 disabled where compatibility requirements allow.

Regular SPN auditing, least-privilege delegation, strong service-account credentials, and behavioral monitoring together can significantly reduce the opportunity for Ghost SPN attacks to turn overlooked Active Directory permissions into stealthy credential compromise.