Windows: Potential Kerberoasting SPN Enumeration via setspn.exe

Detects Windows setspn.exe runs with SPN query command-line parameters that may indicate Kerberoasting preparation.

FreeUnreviewedSigmamediumv1

windows-potential-kerberoasting-spn-enumeration-via-setspn-exe-1eeed653

title: "Windows: Potential Kerberoasting SPN Enumeration via setspn.exe"
id: 3fd587aa-513c-42e3-a014-3417124696b9
status: test
description: This rule flags process executions of setspn.exe that include queries for SPN attributes, consistent with enumerating service principal names. Attackers use SPN enumeration to identify targets for Kerberos-related credential access, which can enable Kerberoasting-style attacks. The detection relies on Windows process creation telemetry, including executable identification (path, original filename, and description text) and command-line content indicating SPN query syntax.
references:
  - https://web.archive.org/web/20200329173843/https://p16.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation
  - https://www.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation/?edition=2019
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_setspn_spn_enumeration.yml
author: Markus Neis, keepwatch, Huntrule Team
date: 2018-11-14
modified: 2023-10-23
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_pe:
    - Image|endswith: \setspn.exe
    - OriginalFileName: setspn.exe
    - Description|contains|all:
        - Query or reset the computer
        - SPN attribute
  selection_cli:
    CommandLine|contains:
      - " -q "
      - " /q "
  condition: all of selection_*
falsepositives:
  - Administration activity
level: medium
license: DRL-1.1
related:
  - id: 1eeed653-dbc8-4187-ad0c-eeebb20e6599
    type: derived

What it detects

This rule flags process executions of setspn.exe that include queries for SPN attributes, consistent with enumerating service principal names. Attackers use SPN enumeration to identify targets for Kerberos-related credential access, which can enable Kerberoasting-style attacks. The detection relies on Windows process creation telemetry, including executable identification (path, original filename, and description text) and command-line content indicating SPN query syntax.

Known false positives

Administration activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.