With Kerberoast, attackers exploit the internals of the Kerberos authentication protocol and generally target privileged domain user accounts. The goal of this attack is to discover the cleartext password of a privileged account, and thereby gain the associated rights. This attack can be performed from inside an Active Directory environment. All an attacker needs is a simple, unprivileged user account.

When the Service Principal Name attribute is set on an account, the underlying security of this account is further affected. Usually, password security policies are configured to lock an account after a few password failures in a row.
However, when this attribute is set, exhaustive password guessing is feasible.

Privileged accounts such as those in the Domain Admins group are usually targeted in Kerberoasting. Getting access to these accounts can lead to a full domain compromise.

By default, this check skips privileged disabled accounts. To also check privileged disabled accounts, please enable thorough tests.

Note: The AD Starter Scan and associated plugins are intended to be used with smaller AD deployments for purposes of preliminary analysis. Accurate preliminary analysis can be expected for AD deployments with up to 5000 users, groups or machines and incomplete results will be returned for larger AD deployments with Nessus, Security Center and Vulnerability Management. For more information on the issues discovered by the Active Directory Starter Scan plugins, please refer to this blog post - https://www.tenable.com/blog/new-in-nessus-find-and-fix-these-10-active-directory-misconfigurations

Detections

Analytics

AD Starter Scan - Kerberoasting

high Nessus Plugin ID 150480

Version 1.106