Modern organizations are steadily moving toward identity-centric security models. Instead of focusing only on endpoints or networks, the emphasis is now on who is accessing what, and how. While this shift strengthens defenses in many ways, it has also opened up new opportunities for attackers.
Today’s adversaries are no longer relying heavily on traditional software vulnerabilities. Instead, they are quietly abusing identity systems, permissions, and trust relationships. One of the most subtle and dangerous examples of this evolution is a refined version of Kerberoasting that uses what can be described as a “ghost SPN” technique.
This approach is clever because it leaves almost no footprint. Attackers briefly modify identity attributes, extract credentials, and then erase all traces of their actions. In many cases, security systems fail to detect anything unusual because the activity appears legitimate when viewed in isolation.
This report explores how this attack works, why it is effective, and what defenders can do to detect and prevent it.
Understanding Kerberoasting in Simple Terms
Kerberoasting is a well-known attack method used in Active Directory environments. It targets service accounts that are associated with Service Principal Names (SPNs).
When a user or system requests access to a service, the Kerberos protocol issues a Ticket Granting Service (TGS) ticket. This ticket is encrypted using the password hash of the service account. If an attacker can obtain this ticket, they can attempt to crack it offline and recover the account’s plaintext password.
Traditionally, attackers would scan the environment to identify existing service accounts and then request tickets for them. This approach, however, creates noise and can trigger detection systems.
The newer method avoids this entirely.
The Shift to “Ghost SPN” Attacks
Instead of targeting existing service accounts, attackers now create their own targets.
They temporarily assign an SPN to a normal user account. This transforms the account into something that looks like a service account from the Kerberos perspective. Once the ticket is generated, they remove the SPN, returning the account to its original state.
This temporary manipulation is what makes the attack so difficult to detect.
How the Attack Works
Step 1: Finding the Right Permissions
After gaining initial access, the attacker explores the environment to identify privilege relationships. In many cases, they discover that the compromised account has GenericAll permissions over another user account.
This level of access allows full control over the target account, including the ability to modify sensitive attributes like SPNs.
This is a common misconfiguration in Active Directory environments and often goes unnoticed.
Step 2: Assigning an SPN Outside Normal Processes
The attacker manually assigns an SPN (for example, http/webapp) to the target account.
This action does not follow standard administrative workflows, which is why it is referred to as an “out-of-band” modification.
From the Kerberos system’s point of view, everything appears normal. The Key Distribution Center (KDC) sees the SPN and treats the account as a valid service principal.
No alarms are triggered because the protocol itself is being used correctly.
Step 3: Requesting the Kerberos Ticket
Once the SPN is set, the attacker requests a TGS ticket for that SPN.
The ticket is encrypted using the target account’s password hash. This allows the attacker to take the ticket offline and begin cracking it without generating any suspicious activity within the network.
There are no repeated login attempts, no failed authentications, and no brute-force alerts.
Step 4: Cleaning Up Evidence
This is where the attack becomes especially stealthy.
After obtaining the ticket, the attacker removes the SPN from the account. The account is restored to its original state, leaving almost no evidence behind.
If directory changes are not closely monitored, this temporary modification may never be noticed.
Why Traditional Detection Fails
Most detection systems rely on patterns such as:
- High volumes of Kerberos ticket requests
- Known service account monitoring
- Suspicious login behavior
The ghost SPN technique bypasses all of these.
The account used may never have been a service account before. The SPN exists only briefly. The ticket request appears legitimate. And the cracking happens entirely offline.
When each action is viewed individually, nothing looks suspicious.
The real issue is the lack of correlation between identity changes and authentication activity.
Bridging the Visibility Gap
To detect this type of attack, organizations need to move beyond isolated log analysis.
Security teams must correlate:
- Directory attribute changes (like SPN assignments)
- Kerberos ticket requests
- Account behavior patterns
Behavior-based detection tools, such as Network Detection and Response (NDR) platforms, are particularly effective in this area.
For example, if a regular user suddenly assigns an SPN—something typically done only by administrators—that deviation alone can be a strong indicator of compromise.
Detection Example: Real-Time Monitoring
A modern NDR system can generate alerts when unusual SPN activity is detected.
What Triggers the Alert
- A non-administrative account modifies SPN attributes
- The behavior deviates from historical patterns
- The action is followed by a Kerberos ticket request
This combination provides strong evidence of suspicious activity.
MITRE ATT&CK Mapping
Mapping this behavior to frameworks like MITRE ATT&CK helps security teams understand the broader context.
This technique is typically associated with:
- Credential Access
- Lateral Movement
- Privilege Escalation
Such mapping improves incident response and helps teams align detection strategies with known adversary tactics.
Remediation and Prevention
Once detected, immediate action is necessary.
Key Response Steps
- Remove unauthorized SPNs
- Reset affected account passwords
- Review and restrict excessive permissions (like GenericAll)
- Audit Active Directory configurations
These steps not only stop the current attack but also reduce the chances of future abuse.
The Bigger Picture: Identity Is the New Attack Surface
This attack highlights a broader trend in cybersecurity.
Attackers are no longer breaking into systems—they are logging in using legitimate permissions. Instead of exploiting software flaws, they are exploiting trust relationships and misconfigurations.
This shift requires a new mindset.
Defenders must monitor not just access attempts, but also how identities themselves are being modified.
Conclusion
The ghost SPN Kerberoasting technique represents a significant evolution in attacker strategy.
By temporarily modifying identity attributes, attackers can extract credentials without triggering traditional alerts. The attack is quiet, efficient, and difficult to trace.
Organizations that rely solely on signature-based detection or isolated log analysis are likely to miss this activity.
To stay ahead, security teams must adopt behavior-based monitoring and focus on identity relationships across the environment.
The future of cybersecurity lies not just in protecting systems—but in understanding how identities behave within them.
Our Analysis and Opinion
From a defensive standpoint, this case clearly shows how attackers are adapting faster than many organizations can respond. What makes this technique particularly concerning is not its complexity, but its simplicity. It does not require zero-day exploits or advanced malware. Instead, it relies on permissions that already exist in the environment.
This raises an uncomfortable but important point: many security risks today are self-inflicted through poor configuration and lack of visibility.
The use of GenericAll permissions is a perfect example. In many environments, such permissions are granted for convenience or operational flexibility, without fully understanding the security implications. Attackers are simply taking advantage of these gaps.
Another key issue is the lack of correlation in traditional SOC operations. Logs are often collected, but not meaningfully connected. A directory change might be logged in one system, while a Kerberos request is recorded in another. Without linking these events, the attack remains invisible.
This is where modern detection strategies must evolve. Behavioral analytics and identity-aware monitoring are no longer optional—they are essential. Organizations need to understand what “normal” looks like for their environment and detect deviations in real time.
Equally important is proactive security hygiene. Regular audits of Active Directory permissions, removal of unnecessary access rights, and strict control over who can modify identity attributes can significantly reduce the attack surface.
There is also a strong case for adopting a Zero Trust approach. Just because an account has permission to perform an action does not mean it should do so without scrutiny. Every action should be validated in context.
In our view, this attack is a wake-up call. It demonstrates that the battle in cybersecurity is shifting from external threats to internal misuse of legitimate access. Organizations that fail to adapt to this shift risk being compromised without ever realizing it.
Ultimately, the solution lies in visibility, discipline, and a deeper understanding of identity systems. Security is no longer just about keeping attackers out—it is about detecting when something inside the system starts behaving in a way it shouldn’t.
