Listen to this Post
In the second part of the Tear Down The Castle series, the focus is on highly privileged service accounts and their risks in Active Directory (AD) environments. A recent Incident Response engagement revealed that a compromised service account led to a full domain takeover, emphasizing the need for proactive security assessments.
Read the full article here: Tear Down The Castle – Privileged Service Accounts
You Should Know: Securing Service Accounts in Active Directory
Service accounts with excessive privileges are prime targets for attackers. Below are verified commands, scripts, and steps to assess and secure them:
1. Identify High-Risk Service Accounts
Use PowerShell to list all service accounts with elevated privileges:
Get-ADServiceAccount -Filter * -Properties PrincipalsAllowedToDelegateToAccount |
Where-Object { $_.PrincipalsAllowedToDelegateToAccount -ne $null } |
Select-Object Name, Enabled, PrincipalsAllowedToDelegateToAccount
#### **2. Check for Kerberoastable Accounts**
Attackers exploit weak service account passwords via Kerberoasting. Detect vulnerable accounts with:
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName, PasswordLastSet |
Where-Object { $_.PasswordLastSet -lt (Get-Date).AddDays(-180) } |
Select-Object SamAccountName, ServicePrincipalName
#### **3. Restrict Dangerous Permissions**
Find service accounts with Dangerous Rights (e.g., Replication, DCSync):
Import-Module ActiveDirectory
Get-ADObject -Filter { ObjectClass -eq "serviceAccount" } |
ForEach-Object {
Get-ACL "AD:\$<em>" |
Where-Object { $</em>.Access.IdentityReference -match "SERVICE_ACCOUNT_NAME" -and $_.Access.ActiveDirectoryRights -match "GenericAll|WriteDacl" }
}
#### **4. Implement Least Privilege**
- Disable unnecessary delegation:
Set-ADServiceAccount -Identity "SvcAccount" -PrincipalsAllowedToDelegateToAccount $null
- Enforce strong passwords & rotation:
Set-ADServiceAccount -Identity "SvcAccount" -PasswordNeverExpires $false
#### **5. Monitor for Anomalies**
Use Windows Event Logs to detect suspicious service account activity:
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4769]]" |
Where-Object { $_.Message -match "SERVICE_TICKET_REQUEST" }
### **What Undercode Say**
Service accounts are often overlooked yet critical in AD security. Attackers exploit weak configurations, leading to lateral movement and domain compromise. Regular audits, least privilege enforcement, and monitoring are essential.
#### **Additional Linux & Windows Commands for Security**
- Linux: Check for rogue service processes:
ps aux | grep -E 'sql|ldap|kerberos'
- Windows: Detect pass-the-hash attacks:
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4624]]" | Where-Object { $_.Properties[8].Value -eq "3" }
### **Expected Output:**
- A list of vulnerable service accounts with excessive rights.
- Detection of Kerberoastable accounts for remediation.
- Hardened AD environment with restricted delegation and strong passwords.
For deeper analysis, refer to: Microsoft AD Security Best Practices
References:
Reported By: Stephan Berger – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
