<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Service Account Auditing — API Reference

## Active Directory Commands

```powershell
# Find all service accounts with SPNs
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName, PasswordLastSet, Enabled, MemberOf

# Find accounts with password never expires
Get-ADUser -Filter {PasswordNeverExpires -eq $true -and Enabled -eq $true} -Properties PasswordLastSet

# Service accounts in privileged groups
Get-ADGroupMember "Domain Admins" -Recursive | Where-Object {$_.Name -like "svc-*"}

# Create Group Managed Service Account
New-ADServiceAccount -Name "gMSA-App" -DNSHostName "gmsa-app.target.com" -PrincipalsAllowedToRetrieveManagedPassword "AppServers"
Install-ADServiceAccount -Identity "gMSA-App"
```

## Impacket Commands

```bash
# Enumerate Kerberoastable accounts
impacket-GetUserSPNs target.com/user:password -dc-ip DC_IP

# Request service tickets
impacket-GetUserSPNs target.com/user:password -dc-ip DC_IP -request -outputfile hashes.txt

# Crack with hashcat (mode 13100 = Kerberos TGS-REP etype 23)
hashcat -m 13100 hashes.txt wordlist.txt
```

## Cloud Service Account APIs

```bash
# AWS: Access key audit
aws iam list-access-keys --user-name svc-deploy
aws iam get-access-key-last-used --access-key-id AKIAXXXXXXXX

# Azure: Service principal credentials
az ad sp credential list --id APP_ID
az ad sp list --filter "startswith(displayName,'svc-')"

# GCP: Key management
gcloud iam service-accounts keys list --iam-account=SA_EMAIL
gcloud iam service-accounts keys create key.json --iam-account=SA_EMAIL
```

## BloodHound Queries

```cypher
# Kerberoastable accounts with paths to high value targets
MATCH (u:User {hasspn:true})-[r:MemberOf*1..]->(g:Group) WHERE g.highvalue=true RETURN u.name, g.name

# Service accounts with admin rights
MATCH (u:User)-[:AdminTo]->(c:Computer) WHERE u.name CONTAINS 'SVC' RETURN u.name, c.name
```

## Key Metrics

| Metric | Target | Check Method |
|--------|--------|-------------|
| Password age | ≤90 days | AD PasswordLastSet |
| Privileged group membership | None | AD MemberOf |
| SPN exposure | gMSA only | AD ServicePrincipalName |
| Key rotation (cloud) | ≤90 days | Cloud CLI key list |
| Interactive logon | Denied | GPO LogonWorkstations |
| Unused accounts | Disabled | LastLogonDate >90 days |
