CAPEC-652 Use of Known Kerberos Credentials

An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.

Kerberos is the default authentication method for Windows domains and is also used across many operating systems. Attacks leveraging trusted Kerberos credentials can result in numerous consequences, depending on what Kerberos credential is stolen. For example, Kerberos service accounts are typically used to run services or scheduled tasks pertaining to authentication. However, these credentials are often weak and never expire, in addition to possessing local or domain administrator privileges. If an adversary is able to acquire these credentials, it could result in lateral movement within the domain or access to any resources the service account is privileged to access, among other things. Ultimately, successful spoofing and impersonation of trusted Kerberos credentials can lead to an adversary breaking authentication, authorization, and audit controls with the target system or application.

1. [Explore] [Acquire known Kerberos credentials] The adversary must obtain known Kerberos credentials in order to access the target system, application, or service within the domain. 2. [Experiment] [Attempt Kerberos authentication] Try each Kerberos credential against various resources within the domain until the target grants access. 3. [Exploit] [Impersonate] An adversary can use successful experiments or authentications to impersonate an authorized user or system, or to laterally move within the domain 4. [Exploit] [Spoofing] Malicious data can be injected into the target system or into other systems on the domain. The adversary can also pose as a legitimate domain user to perform social engineering attacks. 5. [Exploit] [Data Exfiltration] The adversary can obtain sensitive data contained within domain systems or applications.

• The system/application leverages Kerberos authentication. • The system/application uses one factor password-based authentication, SSO, and/or cloud-based authentication for Kerberos service accounts. • The system/application does not have a sound password policy that is being enforced for Kerberos service accounts. • The system/application does not implement an effective password throttling mechanism for authenticating to Kerberos service accounts. • The targeted network allows for network sniffing attacks to succeed.

• [Low] Once an adversary obtains a known Kerberos credential, leveraging it is trivial.

• Confidentiality, Access Control, Authentication: Gain Privileges • Confidentiality, Authorization: Read Data • Integrity: Modify Data

• Create a strong password policy and ensure that your system enforces this policy for Kerberos service accounts. • Ensure Kerberos service accounts are not reusing username/password combinations for multiple systems, applications, or services. • Do not reuse Kerberos service account credentials across systems. • Deny remote use of Kerberos service account credentials to log into domain systems. • Do not allow Kerberos service accounts to be a local administrator on more than one system. • Enable at least AES Kerberos encryption for tickets. • Monitor system and domain logs for abnormal credential access.