[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
New to CAPEC? Start Here
Home > CAPEC List > CAPEC-652: Use of Known Kerberos Credentials (Version 3.9)  
CAPEC-652: Use of Known Kerberos Credentials
Attack Pattern ID: 652
Abstraction: Standard
View customized information:
+ Description
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
+ Extended Description

Kerberos is the default authentication method for Windows domains and is also used across many operating systems. Attacks leveraging trusted Kerberos credentials can result in numerous consequences, depending on what Kerberos credential is stolen. For example, Kerberos service accounts are typically used to run services or scheduled tasks pertaining to authentication. However, these credentials are often weak and never expire, in addition to possessing local or domain administrator privileges. If an adversary is able to acquire these credentials, it could result in lateral movement within the domain or access to any resources the service account is privileged to access, among other things. Ultimately, successful spoofing and impersonation of trusted Kerberos credentials can lead to an adversary breaking authentication, authorization, and audit controls with the target system or application.

+ Likelihood Of Attack

Medium

+ Typical Severity

High

+ Relationships
Section HelpThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.
NatureTypeIDName
ChildOfMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.560Use of Known Domain Credentials
ParentOfDetailed Attack PatternDetailed Attack Pattern - A detailed level attack pattern in CAPEC provides a low level of detail, typically leveraging a specific technique and targeting a specific technology, and expresses a complete execution flow. Detailed attack patterns are more specific than meta attack patterns and standard attack patterns and often require a specific protection mechanism to mitigate actual attacks. A detailed level attack pattern often will leverage a number of different standard level attack patterns chained together to accomplish a goal.509Kerberoasting
ParentOfDetailed Attack PatternDetailed Attack Pattern - A detailed level attack pattern in CAPEC provides a low level of detail, typically leveraging a specific technique and targeting a specific technology, and expresses a complete execution flow. Detailed attack patterns are more specific than meta attack patterns and standard attack patterns and often require a specific protection mechanism to mitigate actual attacks. A detailed level attack pattern often will leverage a number of different standard level attack patterns chained together to accomplish a goal.645Use of Captured Tickets (Pass The Ticket)
CanFollowStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.157Sniffing Attacks
CanPrecedeMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.151Identity Spoofing
Section HelpThis table shows the views that this attack pattern belongs to and top level categories within that view.
View NameTop Level Categories
Domains of AttackSoftware
Mechanisms of AttackSubvert Access Control
+ Execution Flow
Explore

  1. Acquire known Kerberos credentials: The adversary must obtain known Kerberos credentials in order to access the target system, application, or service within the domain.

    Techniques
    An adversary purchases breached Kerberos service account username/password combinations or leaked hashed passwords from the dark web.
    An adversary guesses the credentials to a weak Kerberos service account.
    An adversary conducts a sniffing attack to steal Kerberos tickets as they are transmitted.
    An adversary conducts a Kerberoasting attack.
Experiment

  1. Attempt Kerberos authentication: Try each Kerberos credential against various resources within the domain until the target grants access.

    Techniques
    Manually or automatically enter each Kerberos service account credential through the target's interface.
    Attempt a Pass the Ticket attack.
Exploit

  1. Impersonate: An adversary can use successful experiments or authentications to impersonate an authorized user or system, or to laterally move within the domain

  2. Spoofing: Malicious data can be injected into the target system or into other systems on the domain. The adversary can also pose as a legitimate domain user to perform social engineering attacks.

  3. Data Exfiltration: The adversary can obtain sensitive data contained within domain systems or applications.

+ Prerequisites
The system/application leverages Kerberos authentication.
The system/application uses one factor password-based authentication, SSO, and/or cloud-based authentication for Kerberos service accounts.
The system/application does not have a sound password policy that is being enforced for Kerberos service accounts.
The system/application does not implement an effective password throttling mechanism for authenticating to Kerberos service accounts.
The targeted network allows for network sniffing attacks to succeed.
+ Skills Required
[Level: Low]
Once an adversary obtains a known Kerberos credential, leveraging it is trivial.
+ Resources Required
A valid Kerberos ticket or a known Kerberos service account credential.
+ Indicators
Authentication attempts use expired or invalid credentials.
Authentication attempts are originating from IP addresses or locations that are inconsistent with an account's normal IP addresses or locations.
Data is being transferred and/or removed from systems/applications within the network.
Suspicious or Malicious software is downloaded/installed on systems within the domain.
Messages from a legitimate user appear to contain suspicious links or communications not consistent with the user's normal behavior.
+ Consequences
Section HelpThis table specifies different individual consequences associated with the attack pattern. The Scope identifies the security property that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in their attack. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a pattern will be used to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
ScopeImpactLikelihood
Confidentiality
Access Control
Authentication
Gain Privileges
Confidentiality
Authorization
Read Data
Integrity
Modify Data
+ Mitigations
Create a strong password policy and ensure that your system enforces this policy for Kerberos service accounts.
Ensure Kerberos service accounts are not reusing username/password combinations for multiple systems, applications, or services.
Do not reuse Kerberos service account credentials across systems.
Deny remote use of Kerberos service account credentials to log into domain systems.
Do not allow Kerberos service accounts to be a local administrator on more than one system.
Enable at least AES Kerberos encryption for tickets.
Monitor system and domain logs for abnormal credential access.
+ Example Instances
Bronze Butler (also known as Tick), has been shown to leverage forged Kerberos Ticket Granting Tickets (TGTs) and Ticket Granting Service (TGS) tickets to maintain administrative access on a number of systems. [REF-584]
PowerSploit's Invoke-Kerberoast module can be leveraged to request Ticket Granting Service (TGS) tickets and return crackable ticket hashes. [REF-585] [REF-586]
+ Notes

Other

Kerberos centers around a ticketing system that is used to request/grant access to resources and to then access the requested resources. If one of these tickets is acquired, an adversary could gain access to a specific resource; access any resource a user has privileges to access; gain access to services that use Kerberos as an authentication mechanism and generate tickets to access a particular resource and the system that hosts the resource; or generate Ticket Granting Tickets (TGTs) for any domain account within Active Directory.
+ Taxonomy Mappings
Section HelpCAPEC mappings to ATT&CK techniques leverage an inheritance model to streamline and minimize direct CAPEC/ATT&CK mappings. Inheritance of a mapping is indicated by text stating that the parent CAPEC has relevant ATT&CK mappings. Note that the ATT&CK Enterprise Framework does not use an inheritance model as part of the mapping to CAPEC.
Relevant to the ATT&CK taxonomy mapping (also see parent)
Entry IDEntry Name
1558Steal or Forge Kerberos Tickets
+ References
[REF-584] "BRONZE BUTLER Targets Japanese Enterprises". Secureworks® Counter Threat Unit™ Threat Intelligence. 2017-10-12. <https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses>. URL validated: 2020-05-15.
[REF-585] "Kerberoasting Without Mimikatz". 2016-11-01. <https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/>. URL validated: 2020-05-15.
[REF-586] "Invoke-Kerberoast". <https://powersploit.readthedocs.io/en/latest/Recon/Invoke-Kerberoast/>. URL validated: 2020-05-15.
+ Content History
Submissions
Submission DateSubmitterOrganization
2020-07-30
(Version 3.3)
CAPEC Content TeamThe MITRE Corporation
Modifications
Modification DateModifierOrganization
2020-12-17
(Version 3.4)
CAPEC Content TeamThe MITRE Corporation
Updated Description, Notes, Related_Attack_Patterns
2022-02-22
(Version 3.7)
CAPEC Content TeamThe MITRE Corporation
Updated Description, Extended_Description
2022-09-29
(Version 3.8)
CAPEC Content TeamThe MITRE Corporation
Updated Extended_Description, Prerequisites
More information is available — Please select a different filter.
Page Last Updated or Reviewed: July 30, 2020
 

Use of the Common Attack Pattern Enumeration and Classification (CAPEC), and the associated references from this website are subject to the Terms of Use. Copyright © 2007–2025, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.