SPN Named

Service Principal Names bind Kerberos services to accounts — SPN hygiene on $LAB_AD prevents Kerberoast class risk.

SPN Named• Audio Walkthrough

00:00/03:14

Visual · t25_spn_named

SPN literacy. $LAB_AD only. Original Cyberlium.

Every Kerberos service has an SPN — messy SPNs on user accounts are a defender audit item.

SPN format: serviceclass/host:port/servicename — e.g., HTTP/web01.lab.local. Registered on user or computer accounts. Duplicate or orphaned SPNs break auth; user accounts with SPNs and weak passwords enable Kerberoast class (named in M5 with mitigations only). Cyberlium inventories example SPNs on YOUR $LAB_AD map — not roasting stranger service accounts. Next: Kerberos Lab.

1. SPN registration (named)

Computer accounts get host-based SPNs automatically for many services. User accounts should rarely hold SPNs — when they do, use gMSA or strong random passwords and monitor TGS requests.

On $LAB_AD, list two example SPNs from lab docs and which account type holds them — literacy table only.

Command guide

Try these commands — SPN registration (named)

═══ WINDOWS / POWERSHELL (Lab DC or Joined Machine) ═══

Enumerate user accounts that have a Service Principal Name (SPN) configured

Command — copy this

Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName | Select-Object SamAccountName, ServicePrincipalName

Request a TGS ticket for an SPN on your lab domain (Defender testing)

Command — copy this

Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "HTTP/webserver.lab.local"

View cached Kerberos tickets (look for ticket encryption: RC4 vs AES)

Command — copy this

klist

═══ DEFENDER AUDITING ═══ Monitor Event ID 4769 in Windows Security Log for TGS requests (Ticket Encryption 0x17 = RC4)

Command — copy this

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4769} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-List TimeCreated, Message

Primary tools to practice this lesson: curl, python3. Reference sites: SPN overview (https://learn.microsoft.com/en-us/windows-server/security/kerberos/service-principal-names); MITRE T1558.003 (https://attack.mitre.org/techniques/T1558/003/); Microsoft gMSA (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts-overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Kerberoast connection (named, mitigation focus)

Kerberoast class: request TGS for user-owned SPN, attempt offline crack of service ticket. Defender mitigations: gMSA, long random passwords, reduce user SPNs, detect unusual TGS-REQ patterns, tier service accounts.

Cyberlium names the class — does NOT provide Rubeus/Impacket fire recipes against unauthorized domains.

3. SPN hygiene checklist

Audit user accounts for SPN attributes. Remove stale SPNs. Resolve duplicates. Prefer gMSA for services. Document changes in change control.

Ship: SPN card — format example, two lab SPNs, Kerberoast class one-liner, three mitigations. Next: Kerberos Lab.

4. What you ship: SPN hygiene card for $LAB_AD

SPN format, two lab examples, Kerberoast class + mitigations. NO roast commands. chmod 600.

5. What you record before the next lesson

Date. SPN card. $LAB_AD named. File t25-m03-l03-spn-named.txt chmod 600.

6. Wrong vs right: stranger-domain attacks vs lab AD literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Kerberoast all SPNs on corporate AD. Leave weak service passwords in lab without noting mitigation.
Right: Write SPN card with Kerberoast mitigations for YOUR $LAB_AD. Next: Kerberos Lab.

Hands-on Exercise