Kerberoast target enumeration

ad_spn_kerberoast_recon

Enumerates accounts with a servicePrincipalName — the exact target list a Kerberoast attack works from — and reports how many were found and how many are privileged. No service ticket is requested, so no crackable material is ever obtained.

Severity high how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1087.002	Domain Account Discovery	Discovery	coverage statistics
T1558.003	Kerberoasting	Credential Access	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other discovery tests

Other tests in the Discovery category.
Test	What it does	Severity
Active Directory enumeration ad_domain_enumeration	Runs the read-only directory queries that precede every AD attack: domain controllers, domain and enterprise administrators, password policy, trusts, …	high
Nearest-neighbour subnet scan subnet_neighbour_scan	TCP-connect sweep of up to 24 neighbouring addresses in the local /24 on ports 445/3389/22/80/139. Strictly limited to the local subnet; no payload is…	medium
Host and domain reconnaissance battery host_recon_commands	Runs the read-only enumeration commands that normally follow a successful intrusion (user, group, domain, share, process, network and shadow-copy list…	low

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.