This note documents detection patterns related to SPN Enumeration within Active Directory environments.
Direct Indicators
| Log | Event ID | Meaning | Forensic Value | Notes |
|---|---|---|---|---|
| Security | 4662 | Directory object accessed | High | LDAP queries retrieving servicePrincipalName attributes. |
| Security | 4624 | Successful logon | Medium | Authentication used during enumeration. |
| Security | 4648 | Explicit credentials used | High | Tools authenticating with alternate credentials. |
| Sysmon | 1 | Process creation | High | Execution of enumeration tools such as PowerView. |
| Sysmon | 3 | Network connection | Medium | LDAP queries to domain controllers. |
Indirect Indicators
| Indicator | What To Look For | Forensic Value | Notes |
|---|---|---|---|
| LDAP queries for SPN attributes | Queries requesting servicePrincipalName fields | Critical | Typical Kerberoasting reconnaissance. |
| Enumeration tools execution | PowerView, setspn, or SharpHound | High | Direct discovery activity. |
| Large LDAP query volume | Multiple SPN queries within short time window | High | Automated enumeration behavior. |
Common Tools
| Tool | Usage |
|---|---|
| setspn | Native tool to query SPNs. |
| PowerView | Enumerates service accounts with SPNs. |
| SharpHound | Collects SPN data for BloodHound. |
| GetUserSPNs.py (Impacket) | Enumerates SPNs and prepares Kerberoasting. |
Relevant Artifacts
- Security logs (4662, 4624, 4648)
- LDAP query telemetry
- Sysmon process logs
- EDR telemetry
- Network logs to domain controllers
MITRE ATT&CK References
- T1087 Account Discovery
- T1558.003 Kerberoasting
Decision Tree
- Detect enumeration-related process execution.
- Identify querying host.
- Inspect LDAP query attributes.
- Determine authenticated account.
- Evaluate whether Kerberoasting follows.
Example Detection Templates
KQL
SecurityEvent
| where EventID == 4662
| where ObjectProperties contains "servicePrincipalName"
EQL
any where event.code == "4662"
Sigma
title: SPN Enumeration Activity
logsource:
product: windows
service: security
detection:
selection:
EventID: 4662
condition: selection
level: medium
Mitigation & Hardening
| Control Area | Mitigation | Effectiveness | Notes |
|---|---|---|---|
| Monitoring | Alert on SPN enumeration commands | Medium | Identifies reconnaissance. |
| Audit logging | Enable directory service auditing | High | Improves detection visibility. |
| Service account security | Use strong passwords for SPN accounts | High | Reduces Kerberoasting risk. |