{"id":11624,"date":"2026-03-26T10:03:43","date_gmt":"2026-03-26T10:03:43","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/03\/26\/ghost-spn-attack-lets-hackers-conduct-stealthy-kerberoasting-under-the-radar\/"},"modified":"2026-03-26T10:03:43","modified_gmt":"2026-03-26T10:03:43","slug":"ghost-spn-attack-lets-hackers-conduct-stealthy-kerberoasting-under-the-radar","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/03\/26\/ghost-spn-attack-lets-hackers-conduct-stealthy-kerberoasting-under-the-radar\/","title":{"rendered":"Ghost SPN Attack Lets Hackers Conduct Stealthy Kerberoasting Under the Radar"},"content":{"rendered":"

Ghost SPN Attack Lets Hackers Conduct Stealthy Kerberoasting Under the Radar
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sophisticated evolution of Kerberoasting dubbed the \u201cGhost SPN\u201d attack that allows adversaries to extract Active Directory credentials while erasing all traces of their activity, rendering traditional detection models effectively blind to the intrusion.<\/p>\n

The attack revealed by Trellix security researchers utilizes delegated administrative permissions, creating temporary exposure windows.<\/p>\n

Kerberoasting is a well-documented post-exploitation technique targeting Active Directory (AD) accounts<\/a> registered with Service Principal Names (SPNs).<\/p>\n

When a Ticket Granting Service (TGS) ticket is requested for an SPN, the Kerberos Key Distribution Center (KDC) encrypts it with the target account\u2019s NTLM hash, which attackers can extract and crack offline to recover plaintext credentials.<\/p>\n

The Ghost SPN variant takes this a step further. Rather than enumerating pre-existing service accounts, adversaries exploit delegated directory permissions, such as GenericAll object-level write access, to temporarily assign a fake SPN to an ordinary user account.<\/p>\n

This converts a standard user into an ephemeral Kerberoasting target without touching any known service account, generating zero enumeration-based alerts in the process.<\/p>\n

The Three-Phase Attack Lifecycle<\/strong><\/h2>\n

According to Trelix researchers<\/a>, the attack unfolds across three deliberate phases:<\/p>\n

    \n
  1. \nSPN Assignment (Out-of-Band):<\/strong> The attacker leverages write access to manually assign an arbitrary SPN (e.g., http\/webapp<\/code>) to a target account via PowerShell commandlets. The KDC, seeing a valid service principal, issues a TGS ticket encrypted with RC4-HMAC-MD5 \u2014 standard Kerberos behavior with no anomaly visible at the protocol level.<\/li>\n
  2. \nExtraction and Offline Cracking:<\/strong> The TGS ticket is dumped using tools like Mimikatz and exported as a .kirbi<\/code> file. Cracking occurs entirely outside the environment using tools such as Hashcat or tgsrepcrack.py<\/code>, generating no authentication failures or suspicious login attempts within the target infrastructure.<\/li>\n
  3. \nCleanup and Anti-Forensics:<\/strong> The SPN attribute is immediately cleared, restoring the account to its original state. Without persistent indicators, defenders relying on static directory snapshots or low-fidelity audit logs cannot retroactively link the TGS request to malicious behavior.<\/li>\n<\/ol>\n
    \"\"
    Attack Chain (Source: Trelix)<\/figcaption><\/figure>\n

    This technique directly undermines detection models built around two flawed assumptions: that Kerberoasting targets<\/a> are always pre-registered service accounts, and that malicious activity produces high-volume ticket request anomalies.<\/p>\n

    The targeted account may have never held a service role. The SPN may exist for only seconds. When evaluated in isolation, the activity is indistinguishable from a legitimate administrative action, with a critical visibility gap in SOC stacks relying on fragmented log analysis.<\/p>\n

    Mitigations<\/strong><\/h2>\n

    Organizations should take the following immediate steps:<\/p>\n