CAPEC-652: Use of Known Kerberos Credentials
Description
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Subvert Access Control
Prerequisites
- The system/application leverages Kerberos authentication.
- The system/application uses one factor password-based authentication, SSO, and/or cloud-based authentication for Kerberos service accounts.
- The system/application does not have a sound password policy that is being enforced for Kerberos service accounts.
- The system/application does not implement an effective password throttling mechanism for authenticating to Kerberos service accounts.
- The targeted network allows for network sniffing attacks to succeed.
Skills required
- LowOnce an adversary obtains a known Kerberos credential, leveraging it is trivial.
Consequences
- ConfidentialityAccess ControlAuthentication
Gain Privileges
- ConfidentialityAuthorization
Read Data
- Integrity
Modify Data
Mitigations
- Create a strong password policy and ensure that your system enforces this policy for Kerberos service accounts.
- Ensure Kerberos service accounts are not reusing username/password combinations for multiple systems, applications, or services.
- Do not reuse Kerberos service account credentials across systems.
- Deny remote use of Kerberos service account credentials to log into domain systems.
- Do not allow Kerberos service accounts to be a local administrator on more than one system.
- Enable at least AES Kerberos encryption for tickets.
- Monitor system and domain logs for abnormal credential access.
Related weaknesses (CWE)
- CWE-262Not Using Password Aging
- CWE-263Password Aging with Long Expiration
- CWE-294Authentication Bypass by Capture-replay
- CWE-307Improper Restriction of Excessive Authentication Attempts
- CWE-308Use of Single-factor Authentication
- CWE-309Use of Password System for Primary Authentication
- CWE-522Insufficiently Protected Credentials
- CWE-654Reliance on a Single Factor in a Security Decision
- CWE-836Use of Password Hash Instead of Password for Authentication
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-RTARPC Traffic Analysis1 shared
- D3-TBAToken-based Authentication1 shared
- D3-TBToken Binding1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
- D3-CCSACredential Compromise Scope Analysis1 shared
- D3-CHCredential Hardening1 shared
- D3-CRCredential Revocation1 shared
- D3-CROCredential Rotation1 shared
- D3-CTSCredential Transmission Scoping1 shared
- D3-DUCDecoy User Credential1 shared
- D3-MFAMulti-factor Authentication1 shared
- D3-RICReissue Credential1 shared