Service Principal Name (SPN) scanning is a reconnaissance technique that attackers use in Active Directory environments.

Daniel Petri | Senior Training Manager

Service Principal Name (SPN) scanning is a reconnaissance technique that attackers use in Active Directory environments. This method enables attackers to discover valuable services and associated accounts, which can be potential targets for further attacks such as Kerberoasting.

What is SPN scanning?

Understanding and correctly managing SPNs in Active Directory environments is essential to ensure secure and seamless Kerberos authentication for various services within the network.

In Active Directory contexts, SPNs are unique identifiers assigned to service instances. SPNs are used in Kerberos authentication to associate a service instance with a service logon account. This association is critical for Kerberos to function correctly in an Active Directory environment.

1. When a client wants to access a service on a server, it requests a service ticket from the Key Distribution Center (KDC), part of every Active Directory domain controller.
2. The client specifies the SPN of the service it wants to access. The SPN uniquely identifies this service instance within the domain.
3. Active Directory uses the SPN to find the associated service account and generates a ticket encrypted with that account’s credentials.
4. The client then presents this ticket to the service, which can decrypt it using its own credentials, thus ensuring mutual authentication.

SPN scanning involves enumerating the SPNs that are registered in an Active Directory domain. Attackers scan for SPNs to find service accounts that might have elevated privileges.

SPN scanning is often stealthy. The technique evades standard detection methods by using the legitimate functionality of Active Directory and Kerberos. And unlike some other attacks, SPN scanning doesn’t immediately compromise the service account. Rather, it sets the stage for subsequent attacks.

How does SPN scanning work?

Certain scenarios can make your organization particularly vulnerable to SPN scanning. Understanding these vulnerabilities is key for IT and cybersecurity professionals who aim to strengthen their defenses.

Service accounts with high privileges

Service accounts that have elevated privileges or administer critical services are prime targets for attackers that use SPN scanning. Compromising these accounts can give threat actors broad access to the network. User accounts with administrative rights to crucial services are also at risk. Attackers can use these accounts to perform sensitive operations or to access critical data.

Poorly secured accounts and weak password practices

Accounts with simple or default passwords are highly vulnerable. SPN scanning can lead to credential theft if these passwords are easily crackable.

Misconfigured or excessive SPNs

Excessive or improperly configured SPNs increase the attack surface. Attackers can use these SPNs to identify potential targets. In addition, poor management of SPNs, such as failing to delete SPNs for decommissioned services, creates unnecessary vulnerabilities.

Systems with sensitive data or critical services

Data-rich environments with systems that host sensitive data (e.g., personal information, financial data) are at higher risk if their associated service accounts are compromised. Critical infrastructure services that are crucial for network operations, such as domain controllers or database servers, are particularly vulnerable, as their compromise can have widespread impact.

Lack of robust monitoring and auditing

Networks without effective monitoring and auditing solutions might fail to detect suspicious activities related to SPN scanning. Furthermore, environments without advanced anomaly detection capabilities are less likely to identify unusual query patterns indicative the technique.

Legacy systems and outdated security practices

Legacy systems that are not regularly updated or patched are particularly susceptible to being exploited once an attacker gains initial access. Reliance on outdated security protocols and configurations can leave systems vulnerable to credential theft and lateral movement.

Lack of security awareness and training

Staff unaware of security best practices, particularly regarding password security and phishing threats, can inadvertently increase vulnerability to SPN scanning and subsequent attacks.

SPN scanning attack process

So, how do threat actors use SPN scanning to attack an organization? The following steps are typical in this scenario:

1. Initial reconnaissance and SPN enumeration. The attacker’s primary goal is to identify service accounts, especially those with elevated privileges. Attackers often use built-in Windows tools like setspn, PowerShell cmdlets (Get-ADServiceAccount, Get-ADUser), or third-party tools specifically designed to query Active Directory for SPN enumeration. These queries return a list of SPNs associated with various services in the domain.
2. Target identification. From the enumerated SPNs, the attacker identifies service accounts, particularly looking for accounts that might be poorly secured, have high-level domain access, or are likely to have weak passwords. Certain SPN service types (such as MSSQLSvc for SQL servers) can be more lucrative, as they might run on critical servers.
3. Attack and escalation. Now that the attacker has information about SPNs in Active Directory, they can use this knowledge to attack your network:Kerberoasting. With the identified SPNs, the attacker can then perform Kerberoasting, which involves requesting Ticket Granting Service (TGS) tickets from the KDC for those services. These TGS tickets are encrypted with the service account’s password. The attacker extracts these tickets from memory on their own machine or a compromised host.Offline brute-force attacks. The attacker can use offline brute-force techniques to crack the encrypted portion of the TGS tickets. Tools like John the Ripper or Hashcat are commonly used for this purpose. If successful, this attack reveals the service account’s password in plaintext, giving the attacker access to the service account.Escalation. With control over a service account, the attacker might move laterally within the network, accessing other systems and services. If the compromised account has administrative privileges, this can lead to a complete domain compromise.

What risks are associated with SPN scanning?

The risks associated with SPN scanning in Active Directory environments are significant and multifaceted.

Credential exposure and data access

SPN scanning often leads to the discovery of service accounts, some of which might have elevated privileges. If these accounts are compromised (e.g., through subsequent Kerberoasting attacks), attackers gain access to critical services and data. Service accounts also often have access to sensitive data. An attacker with these credentials can access confidential information, leading to data breaches.

Internal reconnaissance and network mapping

By enumerating SPNs, attackers gain valuable information about the network’s structure, including server roles and services running in the domain. This knowledge facilitates targeted attacks. Attackers can identify high-value assets like domain controllers, database servers, or application servers, which can be primary targets in future attacks.

Lateral movement and privilege escalation

Compromised service accounts, especially those with wide-ranging access, enable attackers to move laterally across the network, accessing multiple systems. If a service account has administrative privileges, attackers can potentially escalate their access to gain control over significant portions of the network, including domain controllers.

Persistence and continued access

With valid credentials, attackers can establish long-term presence in the network, making it challenging to detect and remove them. And compromised service accounts can be used to create backdoors for uninterrupted access, even if the initial entry point is secured.

Bypassing traditional security measures

SPN scanning and subsequent attacks like Kerberoasting often leverage legitimate functionalities of Active Directory and Kerberos, making them harder to detect with traditional security tools. Properly configured service accounts and Kerberos tickets are standard in Active Directory environments. Abusing them can circumvent security measures designed to detect more overt malicious activities.

Business disruption

Compromise of critical service accounts can disrupt operations, leading to downtime and financial losses. Data breaches or noticeable disruptions can also damage an organization’s reputation and erode customer trust.

How can you detect SPN scanning attacks?

Detecting SPN scanning attacks in Active Directory environments requires a combination of advanced monitoring, proper configuration, and awareness of suspicious activities.

Central to this approach is the implementation of advanced auditing and log monitoring. Organizations should configure Active Directory and server auditing to meticulously track access requests to service accounts and SPN queries, while regularly reviewing security logs for unusual patterns, such as a high volume of SPN queries from a single user or IP address.

In addition, employing anomaly detection systems and network traffic analysis is crucial. Security tools that can detect anomalies in network behavior, combined with behavioral analysis solutions, can alert administrators to unusual patterns that might indicate reconnaissance activities. Network monitoring tools analyzing traffic to and from domain controllers can be particularly revealing, as excessive LDAP or Kerberos traffic could signify SPN scanning or Kerberoasting attempts.

Monitoring service accounts for non-routine usage and auditing services for correct SPN configurations can unearth red flags. Concurrently, endpoint detection and response (EDR) tools that monitor endpoints for the use of hacking tools or scripts associated with SPN scanning, integrated with up-to-date threat intelligence, can offer invaluable insights.

Finally, regular audits and compliance checks ensure that networks adhere to security standards and best practices, thus mitigating the risks associated with SPN scanning.

How can you mitigate an SPN scanning attack?

Mitigating SPN scanning attacks in Active Directory environments involves a combination of strategic planning, robust security practices, and proactive monitoring. Effective mitigation not only reduces the risk of such reconnaissance attacks but also strengthens the overall security posture against a variety of threats.

Implement strong security policies for service accounts

Ensuring that service accounts have strong, complex passwords and undergo regular password changes is key to mitigating SPN scanning. Enforcing policies for password complexity diminishes the likelihood of credential compromise.

Additionally, service accounts should be granted only the necessary permissions required for their specific roles, adhering to the principle of least privilege. This reduces the potential damage in case an account is compromised.

Conduct regular audits and clean up SPNs

Conducting regular audits of SPNs within the Active Directory environment can help you to identify and remove unnecessary or outdated SPNs, thereby reducing the attack surface. Proper SPN management includes deleting SPNs for decommissioned services and ensuring that SPNs are correctly configured and associated with the appropriate service accounts. Enhance monitoring and anomaly detection

Implementing advanced monitoring solutions that can detect unusual patterns of SPN queries is crucial. Set up alerts for anomalous activities, such as a high volume of SPN lookup requests, which can indicate reconnaissance efforts. Integrate anomaly detection tools into the security infrastructure to provide early warning signs of potential SPN scanning activities.

Secure endpoints and networks

Use EDR solutions and employ robust network security measures to further mitigate the risk. EDR solutions can detect and respond to indicators of compromise on endpoints. Network security measures, including firewalls and intrusion detection systems, can monitor and control the traffic to sensitive servers, particularly domain controllers.

Conduct education and awareness training

Educating the IT team and end-users about the nature of SPN scanning attacks and their indicators is vital. Regular training sessions and updates on the latest cyber threats, including SPN scanning, and promoting a culture of security awareness across the organization are fundamental steps in fostering a robust security posture and empowering staff to recognize and respond effectively to such threats.

For Active Directory administrators who want to effectively counteract SPN scanning attacks, a comprehensive and proactive approach is essential. Key to this strategy is the enhancement of service account security.

This task involves enforcing strong, complex passwords and strictly applying the principle of least privilege to limit account permissions to only what is necessary for operational roles. Again, conducting regular audits of SPNs within Active Directory is crucial. This includes reviewing and removing outdated or unnecessary SPNs and verifying that existing SPNs are correctly configured and linked to the appropriate service accounts.

On the technical front, enabling advanced security auditing and logging is vital. Administrators should configure policies to meticulously log and monitor access requests to service accounts and SPN queries. They should routinely review these logs for signs of unusual activities, such as spikes in SPN query volumes.

Implementing anomaly detection tools and network monitoring will further strengthen defenses, allowing for the early detection of abnormal behavior patterns in the network that may indicate reconnaissance efforts. Simultaneously, the deployment of EDR solutions is crucial, particularly for monitoring signs of attack tools or unusual script executions.

Other crucial steps include leveraging advanced Active Directory security features, such as the Protected Users group and Credential Guard, and ensuring regular system updates and patches. Finally, developing and routinely testing a well-defined incident response plan for potential security breaches, including steps to take in case of SPN scanning detection, ensures preparedness and a swift, effective response to incidents.

In essence, Active Directory administrators must adopt a multi-layered defense strategy, combining strong service account management, sophisticated monitoring and detection systems, regular training and awareness programs, and the use of advanced AD security features, to effectively mitigate the risks associated with SPN scanning attacks.

Protect Active Directory from SPN scanning

SPN scanning is a critical reconnaissance technique in the arsenal of cyberattackers. This sophisticated reconnaissance method, primarily used for identifying high-value targets in Active Directory environments, leverages legitimate features of Active Directory and Kerberos for malicious purposes, often serving as a precursor to more aggressive attacks. Understanding, detecting, and mitigating this attack form a crucial part of a robust cybersecurity posture for any organization that relies on Active Directory.

Related reading

• How to Protect AD Against Kerberoasting
• SPN-jacking: An Edge Case in WriteSPN Abuse
• ML-Powered Attack Detection

Does your organization run on-prem Active Directory + in-the-cloud Entra ID or Okta?

Then #HIPConf24 is for you. Spend two days learning from the world’s foremost hybrid identity experts in November in New Orleans. Defend your hybrid, multi-cloud environment against current and emerging threats. Follow Hybrid Identity Protection or click picture for details!