CAPEC-652: Use of Known Kerberos Credentials

MITRE CAPEC attack pattern

Description

An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-262, CWE-263, CWE-294, CWE-307, CWE-308, CWE-309, CWE-522, CWE-654, CWE-836

ATT&CK techniques: T1558

Prerequisites

• The system/application leverages Kerberos authentication.
• The system/application uses one factor password-based authentication, SSO, and/or cloud-based authentication for Kerberos service accounts.
• The system/application does not have a sound password policy that is being enforced for Kerberos service accounts.
• The system/application does not implement an effective password throttling mechanism for authenticating to Kerberos service accounts.
• The targeted network allows for network sniffing attacks to succeed.

Skills required

• Low: Once an adversary obtains a known Kerberos credential, leveraging it is trivial.

Consequences

• Confidentiality, Access Control, Authentication: Gain Privileges
• Confidentiality, Authorization: Read Data
• Integrity: Modify Data

Mitigations

• Create a strong password policy and ensure that your system enforces this policy for Kerberos service accounts.
• Ensure Kerberos service accounts are not reusing username/password combinations for multiple systems, applications, or services.
• Do not reuse Kerberos service account credentials across systems.
• Deny remote use of Kerberos service account credentials to log into domain systems.
• Do not allow Kerberos service accounts to be a local administrator on more than one system.
• Enable at least AES Kerberos encryption for tickets.
• Monitor system and domain logs for abnormal credential access.

Source

• MITRE CAPEC CAPEC-652