Active › Module 3 › Lesson 3
SPN Named
Service Principal Names bind Kerberos services to accounts — SPN hygiene on $LAB_AD prevents Kerberoast class risk.
Visual · t25_spn_named
SPN literacy. $LAB_AD only. Original Cyberlium.
Opening
Every Kerberos service has an SPN — messy SPNs on user accounts are a defender audit item.
SPN format: serviceclass/host:port/servicename — e.g., HTTP/web01.lab.local. Registered on user or computer accounts. Duplicate or orphaned SPNs break auth; user accounts with SPNs and weak passwords enable Kerberoast class (named in M5 with mitigations only). Cyberlium inventories example SPNs on YOUR $LAB_AD map — not roasting stranger service accounts. Next: Kerberos Lab.
1. SPN registration (named)
Computer accounts get host-based SPNs automatically for many services. User accounts should rarely hold SPNs — when they do, use gMSA or strong random passwords and monitor TGS requests.
On $LAB_AD, list two example SPNs from lab docs and which account type holds them — literacy table only.
Command guide
Try these commands — SPN registration (named)
═══ WINDOWS / POWERSHELL (Lab DC or Joined Machine) ═══
Enumerate user accounts that have a Service Principal Name (SPN) configured
Command — copy this
Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName | Select-Object SamAccountName, ServicePrincipalNameRequest a TGS ticket for an SPN on your lab domain (Defender testing)
Command — copy this
Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "HTTP/webserver.lab.local"
View cached Kerberos tickets (look for ticket encryption: RC4 vs AES)
Command — copy this
klist
═══ DEFENDER AUDITING ═══ Monitor Event ID 4769 in Windows Security Log for TGS requests (Ticket Encryption 0x17 = RC4)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4769} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-List TimeCreated, MessagePrimary tools to practice this lesson: curl, python3. Reference sites: SPN overview (https://learn.microsoft.com/en-us/windows-server/security/kerberos/service-principal-names); MITRE T1558.003 (https://attack.mitre.org/techniques/T1558/003/); Microsoft gMSA (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts-overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Kerberoast connection (named, mitigation focus)
Kerberoast class: request TGS for user-owned SPN, attempt offline crack of service ticket. Defender mitigations: gMSA, long random passwords, reduce user SPNs, detect unusual TGS-REQ patterns, tier service accounts.
Cyberlium names the class — does NOT provide Rubeus/Impacket fire recipes against unauthorized domains.
3. SPN hygiene checklist
Audit user accounts for SPN attributes. Remove stale SPNs. Resolve duplicates. Prefer gMSA for services. Document changes in change control.
Ship: SPN card — format example, two lab SPNs, Kerberoast class one-liner, three mitigations. Next: Kerberos Lab.
4. What you ship: SPN hygiene card for $LAB_AD
SPN format, two lab examples, Kerberoast class + mitigations. NO roast commands. chmod 600.
5. What you record before the next lesson
Date. SPN card. $LAB_AD named. File t25-m03-l03-spn-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Kerberoast all SPNs on corporate AD. Leave weak service passwords in lab without noting mitigation.
Right
Write SPN card with Kerberoast mitigations for YOUR $LAB_AD. Next: Kerberos Lab.
Mission: document SPN hygiene
1) Write SPN format example. 2) List two lab SPNs and account types. 3) Name three Kerberoast mitigations. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
gMSA on service accounts is the modern default recommendation.
Knowledge Check
APPLY: SPN literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: User accounts with SPNs and weak passwords increase Kerberoast class risk.
True or False
Knowledge Check
APPLY: Kerberoast defender mitigation includes:
Multiple choice