Windows: Potential Kerberoasting SPN Enumeration via setspn.exe
Detects Windows setspn.exe runs with SPN query command-line parameters that may indicate Kerberoasting preparation.
- Product
- windows
- Category
- process_creation
- Author
- Markus Neis, keepwatch (SigmaHQ), DRL 1.1
- Published
- 2018-11-14
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of setspn.exe that include queries for SPN attributes, consistent with enumerating service principal names. Attackers use SPN enumeration to identify targets for Kerberos-related credential access, which can enable Kerberoasting-style attacks. The detection relies on Windows process creation telemetry, including executable identification (path, original filename, and description text) and command-line content indicating SPN query syntax.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20200329173843/https://p16.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation
- praetorian.comhttps://www.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation/?edition=2019
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_setspn_spn_enumeration.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Potential Kerberoasting SPN Enumeration via setspn.exe"
id: 3fd587aa-513c-42e3-a014-3417124696b9
status: test
description: This rule flags process executions of setspn.exe that include queries for SPN attributes, consistent with enumerating service principal names. Attackers use SPN enumeration to identify targets for Kerberos-related credential access, which can enable Kerberoasting-style attacks. The detection relies on Windows process creation telemetry, including executable identification (path, original filename, and description text) and command-line content indicating SPN query syntax.
references:
- https://web.archive.org/web/20200329173843/https://p16.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation
- https://www.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation/?edition=2019
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_setspn_spn_enumeration.yml
author: Markus Neis, keepwatch, Huntrule Team
date: 2018-11-14
modified: 2023-10-23
tags:
- attack.credential-access
- attack.t1558.003
logsource:
category: process_creation
product: windows
detection:
selection_pe:
- Image|endswith: \setspn.exe
- OriginalFileName: setspn.exe
- Description|contains|all:
- Query or reset the computer
- SPN attribute
selection_cli:
CommandLine|contains:
- " -q "
- " /q "
condition: all of selection_*
falsepositives:
- Administration activity
level: medium
license: DRL-1.1
related:
- id: 1eeed653-dbc8-4187-ad0c-eeebb20e6599
type: derived