WriteSPN
Summary
FSProtect ACL Alias
WriteSPN
AD Alias
Validated write to service principle name
Affected Object Types
Users
Exploitation Certainty
Likely
AD Attribute
Service-Principal-Name
AD Right
WriteProperty
AD Permission Guid
f3a64788-5306-11d1-a9c5-0000f80367c1
Description
The WriteSPN permission allows an account to create, update, or remove Service Principal Names (SPNs) on users objects in Active Directory. SPNs serve as unique Kerberos identifiers that associate network services with their service accounts.
Risk
This enables a targeted Kerberoasting attack: the adversary requests a service ticket for the controlled SPN, extracts its hash and cracks it offline to escalate privileges.
Identification
Active Directory Module
Using the ActiveDirectory PowerShell module, you can enumerate WriteSPN entries.
1. Find-WriteSPN Function
2. Scan all domain users
3. Scan a specific user
4. Using SearchBase to limit the searching scope
.NET Directory Services
By leveraging PowerShell’s built-in .NET DirectoryServices namespace, you can enumerate WriteSPN entries without relying on any external modules or dependencies.
1. Find-WriteSPNSimple function
2. Scan all domain users
3. Scan a specific user
Microsoft Common Console Document
1. Open adsiedit.msc on your Windows server.
2. Right-click on the service account name.
3. Select Properties from the context menu.
4. In the Properties window, navigate to the Security tab.
5. Click on the Advanced button to open the Advanced Security Settings dialog.
6. In the Advanced Security Settings window, locate and select the relevant Access Control Entry (ACE) for the user or group you wish to configure.
7. Click Edit to modify the selected ACE.
8. In the permissions list, locate and check the option Write servicePrincipalName
9. Click OK to save your changes and close the dialogs.
Exploitation
Windows
An attacker can change Service Principal Name with this cmdlet on Windows.
Example:
Write Service Principal Name using powerview
Example:
Kerberoasting using Rubeus
Linux
Targeted kerberoasting using targetedKerberoast.py
Example:
Mitigation
Access Control Entries identified as dangerous should be removed by following the steps below.
1. Open adsiedit.msc on your Windows server.
2. Right-click on the Service user name.
3. Select Properties from the context menu.
4. In the Properties window, navigate to the Security tab.
5. Click on the Advanced button to open the Advanced Security Settings dialog.
6. In the Advanced Security Settings window, locate and select the relevant Access Control Entry (ACE) for the user or group you wish to configure.
7. Click Edit to modify the selected ACE.
8. In the permissions list, locate and uncheck the option write to service principal.
9. Click OK and Apply buttons to save changes.
Detection
Changes to the servicePrincipalName attribute can be detected by auditing directory service modifications. Ensure Audit Directory Service Changes (Advanced Audit Policy: DS Access → Audit Directory Service Changes) and Audit Directory Service Access (DS Access → Audit Directory Service Access) are enabled on your Domain Controllers. Look for the following events:
5136
A directory service object was modified.
AttributeLDAPDisplayName (should equal servicePrincipalName)
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
4662
An operation was performed on an object.
AccessMask (e.g., WriteProperty)
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
References
Last updated
Was this helpful?