Ghost SPN Attack Lets Hackers Conduct Stealthy Kerberoasting Under the Radar

A Trellix analysis describes the “Ghost SPN” attack — a Kerberoasting evolution where adversaries abuse delegated Active Directory permissions (e.g., GenericAll or WriteSPN) to temporarily assign service principal names to normal user accounts, obtain TGS tickets encrypted with RC4-HMAC-MD5, extract and crack them offline, then immediately remove the SPN to eliminate forensic evidence. The report outlines a three-phase lifecycle (SPN assignment, extraction/offline cracking, cleanup), explains how the technique defeats traditional detection models, and recommends mitigations including ACL auditing, granular msDS-ServicePrincipalName change logging, enforcing AES-only Kerberos, password resets for exposed accounts, and deploying behavioral NDR.