Active › Module 3 › Lesson 3
SPN Named
Service Principal Names bind Kerberos services to accounts — SPN hygiene on $LAB_AD prevents Kerberoast class risk.
Visual · t25_spn_named
SPN literacy. $LAB_AD only. Original Cyberlium.
Opening
Every Kerberos service has an SPN — messy SPNs on user accounts are a defender audit item.
SPN format: serviceclass/host:port/servicename — e.g., HTTP/web01.lab.local. Registered on user or computer accounts. Duplicate or orphaned SPNs break auth; user accounts with SPNs and weak passwords enable Kerberoast class (named in M5 with mitigations only). Cyberlium inventories example SPNs on YOUR $LAB_AD map — not roasting stranger service accounts. Next: Kerberos Lab.
1. SPN registration (named)
Computer accounts get host-based SPNs automatically for many services. User accounts should rarely hold SPNs — when they do, use gMSA or strong random passwords and monitor TGS requests.
On $LAB_AD, list two example SPNs from lab docs and which account type holds them — literacy table only.
Command guide
Try these commands — SPN registration (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SPN overview — https://learn.microsoft.com/en-us/windows-server/security/kerberos/service-principal-names (SPN literacy) MITRE T1558.003 — https://attack.mitre.org/techniques/T1558/003/ (Kerberoast context — defender view) Microsoft gMSA — https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts-overview (SPN hygiene)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
python3 - <<'PY'
print('SPN format: SERVICE/host.domain — literacy for Kerberoast detection')
print('Defender: audit SPNs on user accounts; prefer gMSA for service accounts')
print('BANNED: GetUserSPNs.py / Rubeus roast against any non-lab domain')
PYCommand — copy this
curl -sS https://learn.microsoft.com/en-us/windows-server/security/kerberos/service-principal-names | head -8
Primary tools to practice this lesson: curl, python3. Reference sites: SPN overview (https://learn.microsoft.com/en-us/windows-server/security/kerberos/service-principal-names); MITRE T1558.003 (https://attack.mitre.org/techniques/T1558/003/); Microsoft gMSA (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts-overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Kerberoast connection (named, mitigation focus)
Kerberoast class: request TGS for user-owned SPN, attempt offline crack of service ticket. Defender mitigations: gMSA, long random passwords, reduce user SPNs, detect unusual TGS-REQ patterns, tier service accounts.
Cyberlium names the class — does NOT provide Rubeus/Impacket fire recipes against unauthorized domains.
3. SPN hygiene checklist
Audit user accounts for SPN attributes. Remove stale SPNs. Resolve duplicates. Prefer gMSA for services. Document changes in change control.
Ship: SPN card — format example, two lab SPNs, Kerberoast class one-liner, three mitigations. Next: Kerberos Lab.
4. What you ship: SPN hygiene card for $LAB_AD
SPN format, two lab examples, Kerberoast class + mitigations. NO roast commands. chmod 600.
5. What you record before the next lesson
Date. SPN card. $LAB_AD named. File t25-m03-l03-spn-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Kerberoast all SPNs on corporate AD. Leave weak service passwords in lab without noting mitigation.
Right
Write SPN card with Kerberoast mitigations for YOUR $LAB_AD. Next: Kerberos Lab.
Mission: document SPN hygiene
1) Write SPN format example. 2) List two lab SPNs and account types. 3) Name three Kerberoast mitigations. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
gMSA on service accounts is the modern default recommendation.
Knowledge Check
APPLY: SPN literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: User accounts with SPNs and weak passwords increase Kerberoast class risk.
True or False
Knowledge Check
APPLY: Kerberoast defender mitigation includes:
Multiple choice