Active Directory Attacks & Defense: Kerberoasting, AS-REP Roasting & Golden Ticket Forgery in Hybrid Azure AD

1. Active Directory: The Enterprise Identity Backbone

Over 90% of Fortune 500 enterprises rely on Microsoft Active Directory (AD) and hybrid Entra ID (Azure AD) to govern enterprise authentication, group policies, and resource access. Because Active Directory was originally architected for internal LAN environments prioritizing interoperability, legacy authentication mechanisms remain enabled for backward compatibility. Threat actors exploit these protocols—specifically Kerberos and NTLM—to achieve rapid domain dominance.

Once inside an internal network, attackers rarely deploy noisy zero-day exploits; instead, they “live off the land” using native AD queries and valid cryptographic tickets to harvest credentials and impersonate domain administrators.

2. The Kerberos Authentication Protocol Flow

Understanding Kerberos attacks requires analyzing the ticket exchange between the client, the Key Distribution Center (KDC / Domain Controller), and target service servers:

+--------+               +---------------------+               +----------------+
| Client |               | KDC (Domain Control)|               | Service Server |
+---+----+               +----------+----------+               +--------+-------+
    |                               |                                   |
    | 1. AS-REQ (Pre-Auth Timestamp)|                                   |
    +------------------------------>|                                   |
    |                               |                                   |
    | 2. AS-REP (TGT + Session Key) |                                   |
    ||                                   |
    |                               |                                   |
    | 4. TGS-REP (Service Ticket)   |                                   |
    ||
    |                                                                   |
    | 6. AP-REP (Mutual Authentication Verified)                        |
    |<------------------------------------------------------------------+

3. Deep Dive into Primary Kerberos Exploitation Vectors

A. Kerberoasting (Targeting SPNs)

Any authenticated domain user can request a Kerberos service ticket (TGS) for any service principal name (SPN) registered in the domain. The KDC encrypts this ticket using the NTLM password hash of the service account associated with that SPN. Because the ticket is delivered to the client, an attacker can extract it from memory and crack it offline without sending further network traffic:

# Querying all Kerberoastable SPNs using Impacket
GetUserSPNs.py corp.local/jdoe:Password123 -dc-ip 10.0.0.5 -request

# Cracking extracted TGS ticket hash with Hashcat (Mode 13100)
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -r rules/best64.rule

B. AS-REP Roasting (No Pre-Authentication)

If an account has the attribute DONT_REQ_PREAUTH (Do not require Kerberos pre-authentication) set, an attacker can send an AS-REQ without possessing the user’s password. The KDC responds with an AS-REP containing encrypted data derived from the user’s password hash, which can be cracked offline using Hashcat mode 18200.

C. Golden Ticket Forgery (Domain Master Key Compromise)

The KRBTGT account password hash is the root cryptographic secret of the Kerberos domain. If an attacker dumps this hash (via DCSync or NTDS.dit extraction), they can forge arbitrary Ticket Granting Tickets (TGTs) claiming membership in Enterprise Admins, granting unlimited domain access that persists even if user passwords change:

# Forging Golden Ticket using Mimikatz
kerberos::golden /user:Administrator /domain:corp.local 
  /sid:S-1-5-21-123456789-123456789-123456789 
  /krbtgt:b8b2e1f422e11a3d9e03d42c3848b5ff 
  /id:500 /ptt

4. Enterprise Active Directory Defensive Framework

1. Deploy Group Managed Service Accounts (gMSA): Replace user-based service accounts with gMSAs. gMSAs feature automated 120-character complex password rotation managed by the OS, rendering offline Kerberoasting mathematically impossible.
2. Audit DONT_REQ_PREAUTH Accounts: Periodically run Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} and remove the flag immediately.
3. Reset the KRBTGT Password Twice: The KDC stores current and previous KRBTGT password hashes. Purging a compromised hash requires rotating the KRBTGT password twice with a 24-hour interval to allow active ticket replication.
4. Implement the Microsoft Tiered Administration Model: Enforce strict tier separation (Tier 0: Domain Controllers; Tier 1: Servers; Tier 2: Workstations). Never allow Tier 0 credentials to log in or leave hashes on Tier 1 or Tier 2 machines.

6. Forensic Analysis of Kerberos Ticket Anomalies

Detecting Kerberos forgery requires deep telemetry into Windows Event Logs on Domain Controllers:

• Event ID 4769 (Kerberos Service Ticket Requested): Monitored for Kerberoasting activity. Look for a single user account requesting dozens of TGS tickets for disparate SPNs in a short time frame, especially when requesting RC4 encryption (Ticket Encryption Type 0x17) instead of AES-256 (0x12).
• Event ID 4768 (TGT Request): Golden Ticket injections bypass Event ID 4768 entirely because the attacker fabricates the TGT locally without contacting the KDC! When an adversary presents a fabricated TGT to request service tickets, Event ID 4769 fires without a preceding 4768, creating an undeniable forensic anomaly.

7. Automated Active Directory Hardening Commands

# 1. Enforce AES-256 on all Service Accounts
Get-ADUser -Filter {ServicePrincipalNames -like "*"} -Properties msDS-SupportedEncryptionTypes | 
    Set-ADUser -Replace @{'msDS-SupportedEncryptionTypes' = 24}

# 2. Add high-privilege administrators to the 'Protected Users' Security Group
Add-ADGroupMember -Identity "Protected Users" -Members "admin_shreyansh", "admin_service"

# 3. Schedule automated bi-annual KRBTGT password rotation
# Requires running the Microsoft New-KrbtgtKeys.ps1 maintenance script twice

Enterprise Incident Response & Compliance Playbook (NIST SP 800-61r2)

When an infrastructure compromise or unauthorized privilege escalation is detected within cloud or on-premise Linux environments, security operations teams must immediately initiate structured containment protocols:

1. Containment & Network Isolation: Immediately apply an ephemeral security group or eBPF network policy isolating the compromised host from the VPC while preserving SSH access from the dedicated forensic subnet. Avoid executing an immediate reboot or VM snapshot that triggers memory reclamation.
2. Volatile Artifact Acquisition: Execute live forensic capture including memory dump (via LiME), active network sockets (ss -tulpn), loaded kernel modules (lsmod), open file descriptors (lsof -p <PID>), and running process trees (ps auxf). Pipe all outputs directly into cryptographically hashed evidence files on write-once storage.
3. Credential Invalidation & Revocation: Rotate all IAM credentials, API access keys, and Kerberos TGT tickets associated with the compromised identity. Flush active sessions in Identity Providers (Okta/Entra ID) using Continuous Access Evaluation Protocol (CAEP) triggers.
4. Root Cause Analysis & Remediation: Identify whether initial access occurred via exposed management ports, unpatched CVEs, or SUID binary abuse. Rebuild the affected host from a known-good immutable golden image (Packer / AMI) and verify CIS Benchmark compliance prior to restoring production traffic.

Key Takeaways, Quantitative Threat Metrics & Executive Audit Summary

Modern enterprise resilience against sophisticated adversarial campaigns requires continuous architectural validation and empirical verification. The following technical telemetry thresholds, executive key performance indicators (KPIs), and architectural controls must be integrated into recurring organizational security audits:

• Mean Time to Detect (MTTD) & Respond (MTTR): Maintain automated detection and alert triage pipelines ensuring suspicious behaviors are flagged in under 3 minutes and contained within 15 minutes of initial execution.
• Zero-Trust Access Invariants: Enforce strict cryptographically verified identity, hardware-bound tokens, and contextual risk scoring across all internal endpoints, removing all perimeter-based implicit trust assumptions.
• Continuous Red Teaming & Adversary Emulation: Execute recurring automated breach and attack simulation (BAS) exercises validating that logging, telemetry streams, and behavioral alerts operate under real-world evasive conditions.
• Regulatory & Industry Compliance: Maintain auditable alignment with NIST SP 800-53r5, ISO/IEC 27001:2022, and CISA Cross-Sector Cybersecurity Performance Goals to ensure verifiable defense-in-depth maturity across all production environments.