No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations

By Maulik Maheta and Henry Bernabe · August 27, 2026

Executive Summary

Active Directory misconfigurations are vulnerabilities that attackers can exploit before defenders notice them. This blog exposes a stealthier evolution in Kerberoasting that weaponizes a common oversight: service principal names (SPNs) assigned to ordinary user accounts instead of service accounts. Because security teams typically audit service accounts for SPNs rather than standard users, this misconfiguration creates a detection blind spot that adversaries can exploit without requiring special privileges or risking account lockout.

This blog will walk through the complete kill chain. We will cover how an attacker enumerates domain-wide SPNs, identifies a vulnerable user account, and silently requests a Kerberos Ticket Granting Service (TGS) ticket encrypted with the weak RC4-HMAC algorithm. The ticket is extracted from memory, saved to disk, and injected back into an attacker-controlled session, completing a pass-the-ticket attack that bypasses password verification entirely and grants unauthorized access to privileged services.

What makes this attack particularly dangerous is its combination of evasion (user-account SPNs are routinely overlooked), persistence (the SPN trap remains active until explicitly removed), and untraceability (offline brute-force cracking leaves no authentication failures in logs). When paired with PowerShell obfuscation and delegated permission abuse, detection becomes exponentially harder using traditional endpoint or log-based monitoring alone.

This is where Trellix Network Detection and Response (NDR) can provide a decisive advantage. In our simulation, Trellix NDR detected SPN enumeration activity at the network layer before credential extraction or lateral movement occurred. Its AI-powered investigation assistant, Trellix Wise, automatically correlated the alert to MITRE ATT&CK T1558.003 (Kerberoasting), surfaced evidence, generated remediation steps, and visualized the full attack chain through a Knowledge Graph. Trellix Wise compressed what would take an analyst hours into seconds. Trellix Hyperautomation uses no-code capabilities, integrations, and a drag-and-drop workflow builder to enable analysts of any level to automate critical processes. Analysts can integrate nearly any tool that has an API and speed responses to threats like phishing emails, credential theft, lateral movement attacks, zero-day vulnerabilities, and more.

What is Kerberoasting?

Kerberoasting is a multi-stage attack that:

• Targets Active Directory (AD) service accounts that have SPNs.
• Requests a Kerberos TGS ticket for that SPN, which is encrypted using the account's password hash.
• Dumps the ticket from memory and uses an offline brute-force attack to crack the hash and recover the plaintext password.

It is powerful because:

• These tickets can be requested without any special privileges.
• There is no account lockout due to offline cracking.

What does "setting the SPN out of band" mean?

In this context, "out of band" refers to the attacker setting or modifying the SPN outside the normal/expected administrative process, often stealthily and without proper logging or detection.

In practice, rather than taking advantage of an already-existing service account SPN, the attacker:

• Compromises an account by giving it permission to modify others (for example, GenericWrite).
• Assigns an SPN to the target user account manually Using PowerShell or tools like  Set-ADUser.
• Disguises the malicious SPN as a legitimate service account attribute within the environment. 
• Kerberoasts this account in the same way that he does other service accounts.

Kerberoasting: Customized scripts to look for interesting SPNs

Figure 1 shows how to manually configure an SPN for a standard user account (e.g, KERBEROAST) in an Active Directory environment. While SPNs are typically associated with service accounts to support Kerberos authentication, assigning them to user accounts is a configuration error that attackers can exploit.

In this simulation, a user account is intentionally configured with an SPN (MSSQLSvc/...) to simulate a real-world misconfiguration scenario. This configuration allows for a Kerberoasting attack, in which adversaries request a Kerberos Ticket Granting Service (TGS) ticket for the SPN and then extract and brute-force the encrypted service ticket offline.

Kerberoasting is the credential-stealing technique primarily used to target user and service accounts, those that have a service principal name set. Typically, service accounts are targeted with this technique because they are more privileged and can grant attackers elevated privileges. Service accounts have a unique identifier, an SPN , used to perform Kerberos authentication.

Figure 2 shows an Active Directory user account with an SPN (MSSQLSvc/...). This is unusual because SPNs are typically assigned to service accounts rather than standard user accounts. Such misconfigurations open the door to Kerberoasting attacks, as attackers can request service tickets for these user-bound SPNs and attempt offline brute-force of their NTLM hashes.

As shown in Figure 3, a custom PowerShell script (SearchSPN.ps1) is used to find high-value SPNs, such as  MSSQLSvc, HTTP, or LDAP, across the domain. These are typically associated with privileged services and make excellent Kerberoasting targets due to the possibility of weak or guessable service account passwords.

As shown in Figure 4, this output displays the result of SPN enumeration; only one SPN is identified and associated with a user for simulation purposes. In real-world scenarios, attackers would be given a list of targets spread across multiple systems, highlighting weaknesses in enterprise-wide SPN configurations.

As shown in Figure 5, the attacker uses PowerShell to request a TGS ticket for the discovered SPN. The ticket is encrypted using RC4-HMAC (etype 0x17), a weak encryption scheme that can be brute-forced offline to recover the associated account's plaintext password.

As shown in Figure 6, the klist command shows the active Kerberos tickets in memory. This includes the TGS's recent request for the vulnerable SPN, which confirms successful ticket caching and enables next-stage ticket dumping.

As shown in Figure 7, Mimikatz exports Kerberos TGS tickets from memory via the kerberos::list /export command. This generates .kirbi files that contain the encrypted ticket data. If service account passwords are weak or guessable, they can be cracked offline.

As shown in Figure 8, the dumped .kirbi ticket file is on disk. These files allow an attacker to either crack the password or use the ticket in a pass-the-ticket attack.

In Figure 9, the attacker repurposes the stolen ticket by injecting it into their session, impersonating legitimate authentication. This allows access to services in the name of the original SPN holder, bypassing password verification entirely.

Figure 10 shows that this likely confirms the successful impersonation of the SPN account following ticket injection. The attacker is now using the target user's privileges, demonstrating a complete pass-the-ticket exploit cycle.

Detection - Trellix Network Detection and Response (NDR)

Trellix NDR utilizes Trellix Wise, an AI-powered investigation assistant, to enhance threat detection and response capabilities. Trellix Wise automates many aspects of alert investigation, reducing false positives and accelerating time-to-resolution for security teams. This integration allows organizations to gain greater threat detection accuracy, automate complex tasks, and focus on strategic defense. 

Trellix Wise can provide a user with comprehensive details, including additional information about the alert, remediation steps, MITRE ATT&CK information, and more.

As shown in Figure 11, this alert overview highlights Trellix NDR's ability to detect Kerberoasting-related behavior. The alert includes key information such as the user who initiated the request, the targeted SPN, and any associated metadata. 

Alert summary

For a summary of the entire alert’s key points, take a look at Figure 12 for a detailed update.

MITRE ATT&CK findings

Figure 13 maps the detection to the MITRE ATT&CK technique. By comparing observed behavior to a known attack technique, the system helps defenders understand the nature and goals of the attack. This classification facilitates standardized reporting, structured threat intelligence sharing, and rapid incident response planning.

Remediation action

Figure 14 shows the specific steps that security teams should take if SPN misuse or Kerberoasting is detected. Passwords for affected accounts will most likely be reset, SPN assignments will be audited, RC4 encryption will be disabled if possible, and enhanced Kerberos logging will be enabled. It serves as a quick response guide, preventing further compromise or privilege escalation.

Knowledge graph

Figure 15 shows the attack's entities, including compromised user accounts, SPNs, requesting systems, processes (such as PowerShell or Mimikatz), and the timeline of activity. The knowledge graph enables analysts to view the entire attack path in a relational format, which is critical for understanding scope, lateral movement, and potential privilege escalation in real time.

Trellix Hyperautomation 

Trellix Hyperautomation uses no-code capabilities, integrations, and a drag-and-drop workflow builder to enable analysts at any level to automate critical processes. Integrate nearly any tool that has an API and speed responses to threats like phishing emails, credential theft, lateral movement attacks, zero-day vulnerabilities, and more.

When a Kerberoasting alert is triggered, Trellix Hyperautomation enables analysts to respond instantly by executing a no-code EDR Isolate Host workflow directly from the alert detail view, automatically disconnecting the compromised endpoint from the network and confining it to management console access only, as confirmed by the loss of internet connectivity on the affected host (Figures 19–20). Once the threat is remediated, the EDR Unisolate Host workflow seamlessly restores the endpoint's full network connectivity (Figures 21–22), completing a contained, auditable response cycle from detection to isolation to recovery without requiring manual intervention or scripting expertise.

Conclusion and recommendations from Trellix

This blog dives into one of Kerberoasting's stealthiest evolutions: exploiting SPN misconfigurations, particularly when SPNs are incorrectly assigned to user accounts rather than service accounts. We showed how attackers can use these out-of-band SPN configurations to silently request Kerberos service tickets, extract them from memory, and recover credentials using offline brute-force techniques, often with little to no immediate trace.

The walkthrough demonstrated how attackers chain together subtle weaknesses in an Active Directory environment to achieve privilege escalation and lateral movement, from initial SPN setup on user accounts to PowerShell-based enumeration, ticket requests, Mimikatz extraction, and pass-the-ticket abuse. These techniques become more effective when combined with PowerShell obfuscation, log evasion, and abuse of  delegated permissions, making detection increasingly difficult.

Recommendations for organizations

• Audit and enforce SPN assignments 
• Eliminate RC4 encryption for Kerberos
• Disable RC4-HMAC (DES/RC4 legacy encryption types)
• Enable Kerberos and LDAP audit logging
• Deploy network-layer detection  
• Build and test an incident response playbook for Kerberoasting

Trellix defense

Trellix NDR detects SPN enumeration at the network layer before credentials are ever cracked, correlating activity to MITRE ATT&CK T1558.003 through Trellix Wise, and enabling analysts to isolate compromised hosts in seconds via Trellix Hyperautomation, all without writing a single line of code. With Trellix NDR, security teams gain the speed and visibility needed to help defend against this type of attack.

To learn more about Trellix NDR, take our product tour to see it in action or read more by visiting this page.

Discover the latest cybersecurity research from the Trellix Advanced Research Center.