Full Report
Explore how Performance Monitor (PerfMon) counters can be used as alternative methods for detecting Kerberos roasting attacks, moving beyond the traditional reliance on Windows Events 4768/4769.
Analysis Summary
# Tool/Technique: PerfMon-Based Kerberos Roasting Detection
## Overview
This technique leverages Windows Performance Monitor (PerfMon) counters and Active Directory ETW (Event Trace for Windows) diagnostics as an alternative telemetry source for detecting Kerberos-based credential theft. Traditionally, defenders rely on Windows Event Logs 4768 and 4769; however, PerfMon counters provide real-time, high-fidelity metadata that can surface anomalies in Kerberos traffic, such as mass Ticket Granting Service (TGS) or Authentication Service (AS) requests, even when traditional logging is bypassed or noisy.
## Technical Details
- **Type**: Technique (Alternative Detection/Monitoring)
- **Platform**: Windows (specifically Active Directory Domain Controllers)
- **Capabilities**: Real-time monitoring of Kerberos authentication requests, LDAP traffic analysis, and diagnostic trace collection.
- **First Seen**: Conceptually discussed in 2018; specific application for "Roasting" detection highlighted January 2025.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- **[T1558 - Steal or Forge Kerberos Tickets]**
- **[T1558.003 - Kerberoasting]**
- **[T1558.004 - AS-REP Roasting]**
- **[TA0007 - Discovery]**
- **[T1087.002 - Account Discovery: Domain Account]**
## Functionality
### Core Capabilities
- **Kerberos Counter Monitoring**: Tracks `Kerberos Authentications` and `TGS Requests` per second.
- **ETW Integration**: Leverages the "Active Directory" event trace session to capture detailed diagnostic information.
- **Anomalous Volume Detection**: Identifies spikes in authentication requests that correlate with automated "Roasting" tools.
### Advanced Features
- **Alternative Telemetry**: Provides a way to detect attacks that attempt to evade standard Security Event Log monitoring.
- **Latency Analysis**: Can potentially measure timing windows (e.g., 60-80ms) to correlate network events with specific service requests.
## Indicators of Compromise
- **Behavioral Indicators**:
- A sudden, sustained spike in `Kerberos Authentications/sec` or `TGS Requests/sec` counters on a Domain Controller.
- Unexpected activation or query of `Active Directory Diagnostics` trace sessions.
- Correlation of high-volume LDAP queries (`Event 1644`) with subsequent Kerberos ticket requests.
## Associated Threat Actors
- **General**: Used by a wide variety of threat actors ranging from penetration testers to sophisticated APTs for internal discovery and credential harvesting.
## Detection Methods
- **Behavioral detection**: Establish a baseline for normal Kerberos traffic volume on DCs; alert on deviations exceeding 3 standard deviations.
- **Tool-Specific Detection**: Monitor for execution of tools like *WonkaVision* or *SOAPHound* which interact with AD telemetry.
- **ETW Monitoring**: Monitor for the creation of new Event Trace Sessions targeting the `Active Directory` provider.
## Mitigation Strategies
- **Prevention measures**:
- Enforce strong, complex passwords for Service Accounts to make offline cracking (Kerberoasting) unfeasible.
- Implement Managed Service Accounts (gMSA) where possible.
- **Hardening recommendations**:
- Disable DES encryption for Kerberos.
- Use "Account is sensitive and cannot be delegated" flag for high-privilege accounts.
- Limit the number of users with Service Principal Names (SPNs).
## Related Tools/Techniques
- **WonkaVision**: A tool designed to surface AD telemetry and detection gaps.
- **SOAPHound**: An Active Directory discovery tool that uses ADWS.
- **LDAPnomnom**: A tool for anonymous LDAP enumeration.
- **Golden Ticket / Silver Ticket**: Advanced Kerberos attacks that these counters may also help identify via abnormal ticket request patterns.