<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-service-account-permissions
description: >-
  Audit service account permissions across Active Directory, cloud platforms,
  and application tiers for excessive privileges, stale credentials, missing
  rotation, SPN exposure, and Kerberoasting susceptibility.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - service-accounts
  - kerberoasting
  - spn
  - active-directory
  - managed-identity
  - credential-rotation
  - least-privilege
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.001"]
---

# Auditing Service Account Permissions

## Overview

Service accounts are high-value targets — they often have elevated privileges,
passwords that never expire, no MFA, and SPNs that make them Kerberoastable.
This skill audits service accounts across AD, Azure, AWS, and GCP for excessive
permissions, stale credentials, missing rotation policies, and attack surface
exposure through SPNs and API keys.

Mode: `[MODE: BLUE]` for auditing; `[MODE: RED]` for Kerberoasting and exploitation.

MITRE ATT&CK: T1558.003 (Kerberoasting), T1078.002 (Valid Accounts: Domain Accounts)

## Prerequisites

- Active Directory RSAT tools or `ldap3` Python library
- `impacket` for Kerberoasting verification
- Cloud CLI tools (az, aws, gcloud)
- Python 3.10+ with `ldap3`, `impacket`
- BloodHound for SPN and delegation graph analysis

## Key Concepts

### Service Account Risk Matrix

| Risk | Indicator | Severity |
|------|-----------|----------|
| Kerberoastable | Has SPN + weak password | Critical |
| Password never expires | `DONT_EXPIRE_PASSWORD` flag | High |
| Stale credential | Password >365 days old | High |
| Over-privileged | Member of Domain Admins | Critical |
| No rotation policy | Not managed by PAM | Medium |
| Interactive logon | Service account used for RDP | High |
| Shared credentials | Same password across accounts | Critical |

### Kerberoasting Detection

```bash
# Enumerate Kerberoastable accounts (Impacket)
impacket-GetUserSPNs target.com/user:password -dc-ip DC_IP -outputfile /tmp/kerberoast.txt

# Crack service ticket hashes
hashcat -m 13100 /tmp/kerberoast.txt /usr/share/wordlists/rockyou.txt

# PowerShell enumeration
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName, PasswordLastSet, Enabled |
  Select-Object Name, ServicePrincipalName, PasswordLastSet, Enabled
```

### Cloud Service Account Audit

```bash
# AWS: List IAM users used as service accounts
aws iam list-users --query 'Users[?contains(UserName, `svc-`)]'
aws iam list-access-keys --user-name svc-deploy
aws iam get-access-key-last-used --access-key-id AKIAXXXXXXXX

# Azure: List service principals
az ad sp list --all --query "[].{Name:displayName,AppId:appId,Created:createdDateTime}"

# GCP: List service accounts
gcloud iam service-accounts list
gcloud iam service-accounts keys list --iam-account=svc@project.iam.gserviceaccount.com
```

## Workflow

### Step 1: Discover Service Accounts

```bash
node scripts/agent.js --domain target.com --discover --output /tmp/svc_inventory.json
```

### Step 2: Audit Permissions

```bash
node scripts/agent.js --input /tmp/svc_inventory.json --audit --output /tmp/svc_findings.json
```

### Step 3: Test Kerberoasting

```bash
# Authorized test — request service tickets
impacket-GetUserSPNs target.com/testuser:password -dc-ip DC_IP -request

# Check password strength of cracked hashes
node scripts/agent.js --input /tmp/kerberoast.txt --crack-audit
```

### Step 4: Remediate

```bash
# Convert to Group Managed Service Account (gMSA)
New-ADServiceAccount -Name "gMSA-WebApp" -DNSHostName "gmsa-webapp.target.com" \
  -PrincipalsAllowedToRetrieveManagedPassword "WebServers"

# Azure: Convert to Managed Identity
az webapp identity assign --name myapp --resource-group mygroup
```

## Detection

```yaml
title: Auditing Service Account Permissions Detection
id: c1ffeeff-3973-4662-bdc3-b4941b35b7fc
status: experimental
description: Detects suspicious activity related to auditing service account permissions techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1078.001
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

- [ ] All service accounts inventoried with owner and purpose documented
- [ ] No service accounts in Domain Admins or Enterprise Admins
- [ ] Kerberoastable accounts use 25+ character passwords or gMSA
- [ ] Password rotation enforced ≤90 days or managed by PAM
- [ ] Interactive logon denied for service accounts
- [ ] Cloud service account keys rotated ≤90 days
- [ ] Unused service accounts disabled
- [ ] Managed identities used instead of service account keys where possible

## References

- [MITRE ATT&CK T1558.003](https://attack.mitre.org/techniques/T1558/003/)
- [Microsoft — Group Managed Service Accounts](https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview)
- [Impacket — GetUserSPNs](https://github.com/fortra/impacket)
- [CIS Controls v8 — Control 5: Account Management](https://www.cisecurity.org/controls/v8)
