Using Windows PerfMon to Detect Kerberos Roasting Activity
Summary
A lab-based demonstration shows how Windows PerfMon counters and Active Directory ETW telemetry can provide context for detecting Kerberoasting, AS-REP roasting, and related attacks beyond relying only on Windows Events 4768 and 4769.
Key points
- PerfMon’s Active Directory Diagnostics data collector can capture ETW information useful for monitoring domain activity.
- Kerberoasting tests produced evidence of mass TGS requests by one account and an associated LDAP query.
- AS-REP roasting tests showed AS requests and LDAP queries involving accounts configured without pre-authentication.
- Roasting from the AS produced a spike in the Kerberos AS Requests counter during the lab test.
- The author notes that PerfMon is not designed as a direct detection source or necessarily for scalable, real-time alerting; its data could enrich analysis collected elsewhere.
- The post also demonstrates that PerfMon can capture context about obfuscated LDAP queries.
Article Details
- Defense Focus
- Detect Kerberos roasting and LDAP activity by analyzing Active Directory ETW telemetry and Kerberos performance counters, supplementing rather than relying solely on Windows Events 4768 and 4769.
- Detection Methods
- Use the Active Directory Diagnostics Data Collector Set to capture Event Trace for Windows (ETW) data before attack execution.
- Look for mass TGS requests from a single account and LDAP queries containing serviceprincipalname=* as Kerberoasting indicators.
- Look for AS requests and LDAP queries involving accounts configured not to require pre-authentication as AS-REP Roasting indicators.
- Look for mass AS ticket requests and spikes in the Kerberos KDC AS Requests performance counter as indicators of Roasting from the AS.
- Analyze LDAP query patterns, obfuscation, source IPs, and user accounts to identify suspicious behavior and add context.
- Data Sources
- Active Directory event trace session via ETW
- Kerberos performance counters, including KDC AS Requests
- LDAP query telemetry
- Windows Events 4768 and 4769 as conventional Kerberos telemetry for comparison
- Rule Types
- Behavioral detections for unusually high-volume TGS or AS requests
- LDAP query-pattern detections
- Performance-counter anomaly detection
- Platforms
- Windows Performance Monitor (PerfMon)
- Windows Domain Controllers
- Active Directory
- Defensive Actions
- Collect and analyze the underlying performance and ETW data through suitable detection sources; PerfMon itself is not designed as a direct detection source.
- Use client/server relationships, source IPs, and user-account context to investigate suspicious Kerberos and LDAP activity.
- Do not depend exclusively on Windows Events 4768 and 4769 for Kerberos attack detection.
- Account for obfuscated LDAP queries when developing detection logic.
MITRE ATT&CK
T1558.003 · KerberoastingThe article demonstrates a Rubeus Kerberoast attack that generates mass TGS requests and an LDAP query for serviceprincipalname=*.T1558.004 · AS-REP RoastingThe article demonstrates a Rubeus AS-REP Roasting attack against accounts configured not to require pre-authentication.
People
Products
Microsoft Active Directorycan also be used to monitor domain-related performance, including authentication processes and Active Directory activity, providing valuable insights into Kerberos-related eventsMicrosoft WindowsI first began looking into “alternate” means of Kerberos telemetry (i.e., beyond the standard/norm of Windows Events 4768/4769) when Charlie Clark and I released our tool WonkaVision during our talk “I’ve Got aPerformance Monitoryeah, what is it good for?" Well, from a purple teamer’s perspective, the same can be asked of Performance Monitor (PerfMon), and the answer will be the same—"ABSOLUTELY NOTHING!”
Tools
MaLDAPtiveinterpreters or the command line are not new, but they may be gaining more traction with the release of MaLDAPtive. Charlie Clark’s -Obfuscate function in his fork of PowerView has been around since 2021. Using thisPowerViewmore traction with the release of MaLDAPtive. Charlie Clark’s -Obfuscate function in his fork of PowerView has been around since 2021. Using this function, we can send obfuscated LDAP queries to our DomainRubeusSet (System), we can start a trace prior to attack execution. Running a simple Kerberoast attack with Rubeus, with no “opsec” employed, the following results are returned:WonkaVisionbeyond the standard/norm of Windows Events 4768/4769) when Charlie Clark and I released our tool WonkaVision during our talk “I’ve Got a Golden Twinkle in My Eye” at SANS PenTest HackFest 2022.